Documents
This page is generated from the in-app guide content — edit
featureToggleGuidesand runpnpm gen:feature-toggle-docs.
Approval required to publish
A publication must be approved through the workflow before recipients are notified.
| Code | Default | Switch at | Turn on first |
|---|---|---|---|
documents.approval_required_for_publish | Off | /documents/settings | — |
How it works
Checked when a document is published to recipients (Publish & request acknowledgement).
Conditions for it to take effect
An active approval workflow for document publications must exist — otherwise publishing fails with an error instead of silently going out.
When ON
The publication is submitted for approval; recipients are staged and are only notified once the workflow approves it.
When OFF
Recipients are notified as soon as the document is published.
Screens, documents and reports affected
Documents → Publish; Approvals inbox.
Caveats
Does not affect uploads, sharing, or Knowledge Base articles (those have their own switch knowledge.approval_required_for_publish).
Block external share for confidential
Confidential or restricted documents cannot be shared via public links.
| Code | Default | Switch at | Turn on first |
|---|---|---|---|
documents.block_external_share_for_confidential | On | /documents/settings | — |
How it works
Checked when a public (token) share link is created — on both share-link routes — and again every time someone opens an existing link.
When ON
Documents marked confidential or restricted cannot get a public link, and links issued earlier stop working as soon as the document is raised to one of those levels.
When OFF
Confidential and restricted documents can be shared by public link like any other document.
Screens, documents and reports affected
Documents → Share → public link; opening shared links.
Caveats
On by default. Internal sharing to users or departments is not affected. If the configuration cannot be read when a link is opened, access to a confidential document is refused.
Purge hidden versions
Permanently delete the stored file of hidden versions after the retention period. The version row is kept for audit.
| Code | Default | Switch at | Turn on first |
|---|---|---|---|
documents.purge_hidden_versions | Off | /documents/settings | — |
How it works
A nightly job (03:35) looks for document versions that were hidden longer ago than the retention period and deletes their stored file.
When ON
Files of versions hidden more than “Version retention (days)” ago are removed from storage; the version row stays, stamped as purged, for audit.
When OFF
Hidden versions keep their file indefinitely.
Screens, documents and reports affected
Documents → version history; file storage.
Caveats
Irreversible for the purged file. Only hidden versions are touched — the current version and visible versions never are. A failed storage delete is retried on the next run. Off by default.
Require category on upload
A user upload into the library must have a document category; attachments uploaded from other apps are exempt.
| Code | Default | Switch at | Turn on first |
|---|---|---|---|
documents.require_category_on_upload | Off | /documents/settings | — |
How it works
Checked on every upload into the shared library: the upload must carry a document category from Documents › Categories.
Conditions for it to take effect
Create at least one document category first — with none, every library upload is rejected.
When ON
An upload into the library without a category is rejected with an error; the upload form marks the category field as required.
When OFF
Category is optional on upload.
Screens, documents and reports affected
Documents → upload (library folders).
Caveats
Files landing in an app folder (Apps/‹App›/…, e.g. attachments from Sales or HR) and system placements are exempt. Existing documents without a category are not touched. Off by default for new companies.
Restrict delete to admin
Only a Documents administrator may delete documents (move them to the trash), single or bulk.
| Code | Default | Switch at | Turn on first |
|---|---|---|---|
documents.restrict_delete_to_admin | Off | /documents/settings | — |
How it works
Checked on single delete and bulk delete of documents.
When ON
Only users holding documents:admin (or a wildcard) can delete documents; everyone else gets a permission error, even on their own uploads.
When OFF
Anyone with write access to the document can delete it.
Screens, documents and reports affected
Documents → Delete, bulk delete.
Caveats
Delete moves the document to the trash (it can be restored); it is not a permanent purge. Cleanup run by the system is exempt. Force-deleting a document still attached to another record needs documents:admin regardless of this switch.
Version retention (days)
Days a hidden version is kept before its file is purged. Minimum 30 days; 0 turns purging off.
| Code | Default | Switch at | Turn on first |
|---|---|---|---|
documents.version_retention_days | 90 | /documents/settings | Purge hidden versions (documents.purge_hidden_versions) |
How it works
Read by the nightly purge job together with “Purge hidden versions”.
Conditions for it to take effect
“Purge hidden versions” must be on — the field is locked until then.
When ON
A hidden version’s file is purged once it has been hidden for this many days (default 90).
When OFF
0 turns purging off even while the switch above is on.
Screens, documents and reports affected
Documents → version history; file storage.
Caveats
There is a hard floor of 30 days: any value from 1 to 29 is treated as 30.
Example
90 → a version hidden on 1 March loses its file in the first nightly run after 30 May.
Watermark on download
Apply a tenant watermark when confidential documents are downloaded.
| Code | Default | Switch at | Turn on first |
|---|---|---|---|
documents.watermark_on_download | Off | /documents/settings | — |
How it works
Checked whenever a document is downloaded or previewed: if the document is confidential or restricted and its file type can be stamped, the file is served through a watermarking step.
When ON
Downloads and previews of confidential/restricted PDFs and images carry a watermark.
When OFF
Files are served as stored, without a watermark.
Screens, documents and reports affected
Documents → download, preview, shared links.
Caveats
Public and internal documents are never watermarked. File types that cannot be stamped are served unchanged. The stored original is not modified.