Upload protection
Overview
Every file that enters the system passes the same check — in the document area, on a task, in the customer portal, through a form or when importing from another system. On this page you, as the operator, decide what that check lets through.
What is checked is the file's content, not its name and not the type the uploading program claims. A renamed file therefore cannot slip past the list. Every file is always delivered as a download with the detected type, never opened directly in the browser.
Core tasks
Set the maximum size. The default is 25 MB per file. Larger values help with screen recordings, for example. Note that the web server has its own upload limit as well; imports from other systems are not affected by it.
Allow or block file types. The list holds the allowed types in the form type/subtype, for example application/pdf or text/markdown. Add types or remove them. Restore defaults resets list and size to the defaults.
Allow all file types. The switch lifts the list: any content is accepted, including program code, archives or key files. This applies to every upload path, including customers in the portal. Use it deliberately, for a one-off migration say, and switch it off again afterwards.
Fields in detail
| Field | Required | Values / format | What it does |
|---|---|---|---|
Maximum size (MB) maxMb | yes | 1 to 10,240 | Larger files are rejected with a message. The interface shows the limit at every upload spot. |
Allow all file types allowAnyType | no | on or off | On: any content is accepted, the type list rests. Off: only the types on the list. |
Allowed file types allowedMimeTypes | no | list of type/subtype | Which content is accepted. An empty or unchanged list means the default list applies. |
Settings & permissions
- Permission
platform.settings.manageto change it. Every signed-in employee may read it,
because the interface needs the maximum size for its advance check.
- Takes effect immediately. After saving, the new rule applies to the next upload, no restart.
- Through the interface the same setting is available at
/api/v1/files/upload-policy— for
automations and AI tools as well.
FAQ & troubleshooting
A file is rejected as "file type not allowed". The detected content is not on the list. Add the type or switch on Allow all file types for a while.
"The declared file type does not match the content." The uploading program claims a type from a different family than the content — an image posing as a PDF, for instance. The system rejects that as a possible deception. Deviations within one family (a Markdown file detected as text) are allowed.
A customer still cannot upload a large file in the portal. Then the web server's limit applies. It is set at the hosting provider, not here.