Uploads: accepted types, size limits, where files go

What is accepted

• Images: JPG, PNG, WebP, HEIC (iPhone photos are converted). Re-encoded on arrival, which removes location data and anything hidden inside.
• Documents: PDF only. Word files are not accepted; export to PDF first, which also freezes the content.
• Size: up to 10 MB per file. A photo from a modern phone is usually 2–4 MB; a scanned lease is under 1 MB per page.

Anything else — ZIPs, scripts, spreadsheets — is refused with a message saying why. The restriction is part of what keeps a file from being something other than it claims.

Where files go

Encrypted before they touch disk, stored outside the web root under a random name, listed in your database by their hash. No path on the server corresponds to a URL. Downloads go through the gate, a permission check on the record the file belongs to, and decryption, and each one is logged with who and when.

Who can open what

A file belongs to a record — a client, a ticket, an expense — and inherits that record's visibility. A receptionist can open a tenant's lease because she can open the tenant; she cannot open a staff member's employment contract because she cannot open staff records. A tenant can download their own signed lease from the portal and nothing else.

Deleting

Deleting a record's file removes the database entry at once and the encrypted blob in the nightly run. Purging a past tenant under your retention policy does the same for all their files together. Backups that still contain the file age out on the normal schedule.