seqeralabs · christopher-hakkaart · Jul 31, 2026 · Aug 4, 2026 · Aug 6, 2026
diff --git a/platform-cloud/docs/data/data-explorer.md b/platform-cloud/docs/data/data-explorer.md
@@ -2,7 +2,7 @@
 title: "Data Explorer"
 description: "Using Seqera Data Explorer."
 date created: "2023-04-21"
-last updated: "2026-07-02"
+last updated: "2026-07-31"
 tags: [data, explorer, igv, molstar, object, storage, lineage]
 ---
 
@@ -16,6 +16,19 @@ If you use Seqera Cloud and want to disable Data Explorer, [contact](https://seq
 
 The role assigned to a workspace user affects what functionality is available in Data Explorer. These permissions are listed in the [Participant roles][roles].
 
+## Access control
+
+Two mechanisms control Data Explorer access:
+
+- **Participant roles** determine which Data Explorer actions a workspace user can perform, such as browsing, previewing, downloading, and uploading. See [Participant roles][roles].
+- **Credentials** determine which objects those actions can reach. Each data-link uses the credentials you select when you add the data repository to the workspace. The cloud provider permissions attached to those credentials define the scope of Data Explorer access to that repository. To narrow what Data Explorer can do in a bucket, assign that data-link a dedicated credential with a more restrictive cloud provider policy. Sharing one broad credential across compute environments and data repositories gives Data Explorer the full scope of that credential.
+
+Data Explorer has no per-bucket or per-workspace setting that disables downloads or uploads while leaving browsing available. To remove download and upload access completely, disable Data Explorer for your entire Seqera Cloud account.
+
+:::warning
+Cross-origin resource sharing (CORS) is not an access-control mechanism. Browsers enforce CORS, and it covers only the upload, multi-file download, and genome preview paths described in [CORS configurations for cloud providers](#cors-configurations-for-cloud-providers). Leaving a bucket's CORS configuration unset does not prevent Data Explorer users from reaching the objects in that bucket. CORS has no effect on access through the Seqera Platform API, the Seqera Platform CLI (`tw`), or your cloud provider's tools. Use credentials and cloud provider access policies to control access to your data.
+:::
+
 ## Add data repository links
 
 Data Explorer lists public and private data repositories. Repositories accessible to your workspace credentials are retrieved automatically. Workspace maintainers can also configure repositories manually.
@@ -181,7 +194,7 @@ The code snippet is specific to the data repository provider you configured. Onl
 
 ## CORS configurations for cloud providers
 
-Each cloud provider has a specific way to allow Cross-Origin Resource Sharing (CORS) for uploads, multi-file downloads, and genome file previews (IGV).
+Each cloud provider has a specific way to allow Cross-Origin Resource Sharing (CORS) for uploads, multi-file downloads, and genome file previews (IGV). CORS enables these browser-based paths, but it is not an access-control mechanism. See [Access control](#access-control) for the mechanisms that restrict access to your data.
 
 ### Amazon S3 CORS configuration
 

diff --git a/platform-enterprise_docs/data/data-explorer.md b/platform-enterprise_docs/data/data-explorer.md
@@ -2,16 +2,14 @@
 title: "Data Explorer"
 description: "Using Seqera Data Explorer."
 date created: "2025-05-08"
-last updated: "2026-07-02"
+last updated: "2026-07-31"
 tags: [data, explorer]
 ---
 
 With Data Explorer, you can browse and interact with remote data repositories from organization workspaces in Seqera Platform. It supports AWS S3, Azure Blob Storage, Google Cloud Storage, and Amazon S3-compatible API storage (for example, Cloudflare R2, MinIO, and Oracle Cloud).
 
 Access the **Data Explorer** tab from any workspace to view and manage all available data repositories. Data Explorer is also integrated with the pipeline launch form, run detail pages, and Studios. Use these integrations to select input data files and output directories, view the output files of a run, or use files in object storage directly for interactive analysis.
 
-If you use Seqera Cloud and want to disable Data Explorer, [contact](https://seqera.io/contact-us/) your Seqera account executive.
-
 ## Participant roles
 
 The role assigned to a workspace user affects what functionality is available in Data Explorer. These permissions are listed in the [Participant roles][roles].
@@ -23,6 +21,22 @@ The role assigned to a workspace user affects what functionality is available in
 - **Admin**: Can view, download, upload, and preview contents of cloud storage buckets. Can hide and add buckets.
 - **Owner**: Can view, download, upload, and preview contents of cloud storage buckets. Can hide and add buckets.
 
+## Access control
+
+Two mechanisms control Data Explorer access:
+
+- **Participant roles** determine which Data Explorer actions a workspace user can perform, such as browsing, previewing, downloading, and uploading. See [Participant roles][roles].
+- **Credentials** determine which objects those actions can reach. Each data-link uses the credentials you select when you add the data repository to the workspace. The cloud provider permissions attached to those credentials define the scope of Data Explorer access to that repository. To narrow what Data Explorer can do in a bucket, assign that data-link a dedicated credential with a more restrictive cloud provider policy. Sharing one broad credential across compute environments and data repositories gives Data Explorer the full scope of that credential.
+
+Data Explorer has no per-bucket or per-workspace setting that disables downloads or uploads while leaving browsing available. Two instance-level [environment variables](../enterprise/configuration/overview#data-features) control Data Explorer availability:
+
+- `TOWER_DATA_EXPLORER_ENABLED` enables or disables Data Explorer for every workspace in your Enterprise instance. This is the only way to remove download and upload access completely.
+- `TOWER_DATA_EXPLORER_CLOUD_DISABLED_WORKSPACES` disables automatic cloud bucket retrieval in the listed workspaces. This is not a download or upload control. Manually added data-links remain usable in those workspaces.
+
+:::warning
+Cross-origin resource sharing (CORS) is not an access-control mechanism. Browsers enforce CORS, and it covers only the upload and multi-file download paths described in [CORS configurations for cloud providers](#cors-configurations-for-cloud-providers). Leaving a bucket's CORS configuration unset does not prevent Data Explorer users from reaching the objects in that bucket. CORS has no effect on access through the Seqera Platform API, the Seqera Platform CLI (`tw`), or your cloud provider's tools. Use credentials and cloud provider access policies to control access to your data.
+:::
+
 ## Add data repository links
 
 Data Explorer lists public and private data repositories. Repositories accessible to your workspace credentials are retrieved automatically; workspace maintainers can also configure repositories manually.
@@ -156,7 +170,7 @@ The code snippet is specific to the data repository provider you configured. You
 
 ## CORS configurations for cloud providers
 
-Each cloud provider has a specific way to allow Cross-Origin Resource Sharing (CORS) for both uploads and multi-file downloads.
+Each cloud provider has a specific way to allow Cross-Origin Resource Sharing (CORS) for both uploads and multi-file downloads. CORS enables these browser-based paths, but it is not an access-control mechanism. See [Access control](#access-control) for the mechanisms that restrict access to your data.
 
 ### Amazon S3 CORS configuration