Uploads & attachments

A handful of surfaces accept file uploads. They all go through one pipeline with one set of rules, so this page documents them once.

Where you can upload

Surface	What	Who
Messages — the composer’s “+” button	An image attachment on a message	Every role
Settings → Profile	Your profile photo	Clients (the vendor profile-photo control isn’t wired to an upload yet)
Settings → General	The workspace logo	Client workspace owners

Find the profile and workspace controls under Settings in your own workspace; the exact page lives in your role’s section of these docs.

Everything else that looks like a file on the platform — invoices, statements, exports — is generated by the app, not uploaded to it. (Billing exports are CSVs the app produces; see your role’s Billing/Earnings/Commissions page.)

The rules

Every upload, on every surface, is checked the same way:

• Images only — PNG, JPEG, GIF, or WebP. The platform identifies the format from the file’s actual content, not its name or extension, so renaming report.pdf to report.png doesn’t get it through: “Only PNG, JPEG, GIF, or WebP images are allowed.”
• 2 MB maximum — larger files are refused: “Images must be 2 MB or smaller.” Oversized uploads are rejected up front, before the file is transferred and buffered.
• Signed in — uploading requires an authenticated session (viewing does not; see below).

How uploaded files are stored and served

• Each upload is stored under a random identifier — never your name, your account, or the original filename. Nothing about the resulting URL identifies who uploaded it or what it contains, and identifiers can’t be guessed or enumerated.
• Files are served from /api/v1/files/{id}. The link works for anyone who has it — that’s what lets your avatar render for the people who see you in the app — but is unguessable to anyone who doesn’t. Treat an uploaded image’s URL like the image itself: sharing the link shares the picture.
• Uploads are immutable: changing your avatar or logo uploads a new file and re-points your profile at it; the identifier itself never serves different content. (Message attachments are as permanent as messages — there’s no edit or delete.)

When an upload fails

The surface you uploaded from shows the reason inline — the size and format messages above, or a generic “Could not upload the image. Please try again.” for network hiccups. A failed message attachment never loses your draft: the composer keeps your text so you can retry.