Files and storage access
Files live in Supabase Storage. Only editors of a file's workspace can upload or delete. Imported PDFs are private, but images, screenshots and videos open for anyone with their random address.
On this page
The buckets
| Bucket | Holds | Readable by | Limit |
|---|---|---|---|
doc-imports |
PDFs uploaded to draft an SOP | Private. Signed in members of the workspace, and short lived signed links | 32 MB |
step-images |
Images added to steps and cards | Anyone with the file’s address | 20 MB |
guide-frames |
Frames from recorded videos and capture screenshots | Anyone with the file’s address | 10 MB |
guide-videos |
Original videos kept in a card | Anyone with the file’s address | 500 MB, video types only |
playbook-media |
Media migrated from an earlier system | Anyone with the file’s address; writable only by SOPCompass | 1 GB |
Who can upload and delete
Storage policies are enforced by Supabase, not the browser:
- Upload and delete in
step-images,guide-framesandguide-videosrequire being an owner, admin or editor of the workspace named in the file’s path. Viewers, people from other workspaces and anonymous visitors are refused. - The capture extension can upload a screenshot only to the one exact path the database issued for that step, only while the capture is running, and only within 30 minutes. It can’t overwrite or delete anything.
- Every file path starts with its workspace’s id, and policies compare that folder against your memberships.
Why most files are public by address
Images and videos need to display on shared SOPs, in embeds and in the Word export, so they are served from public addresses. Those addresses contain long random names, so files can’t be listed or guessed. But:
Important: Anyone who has a file’s exact address can open that file without signing in, and revoking a share link doesn’t change the address. Don’t put sensitive images, screenshots or videos into SOPs. For screenshots from the capture extension, review each one before publishing and delete any that show personal or confidential information.
Imported documents
PDFs uploaded to draft an SOP go to the private doc-imports bucket. The AI receives a signed link that expires after 10 minutes, and the app deletes the file as soon as the draft comes back. Word, text and other document types are read in your browser and never uploaded. Audio recordings are transcribed in your browser and never uploaded.
What we know isn’t perfect
- Removing an image or step from an SOP doesn’t always delete the underlying file from storage. Files removed during a video import or a capture review are deleted.
- Files are not included in the database backups Supabase keeps. See Backups.
To have files removed from storage, email support@ironbridgeaiadvisory.com.
Common questions
Can someone outside my workspace open an image from my SOP?
Only if they have its exact address. Images, screenshots and videos are served from public addresses with long random names, so they can't be listed or guessed, but anyone who has the address can open the file without signing in.
Are imported PDFs public?
No. PDFs uploaded for drafting go to a private bucket, readable only by members of the workspace and by a 10 minute signed link given to the AI, and the app deletes the file once the draft is back.