How media and files are stored

Every picture, PDF, video and audio file in your content lives in private storage that belongs to your agency. By the end of this page you will know how a file gets there, how it is tracked and counted against your plan, how the console and the operator app are allowed to read it, and which few files are public on purpose.

Private buckets, one folder per agency

Content files go into four private buckets, one per kind. Each bucket has its own size limit and list of accepted formats, and storage refuses anything outside them:

Images are prepared in your browser before they upload: turned the right way up, reduced to at most 2048 pixels on the long side, and saved as JPEG (photos) or PNG (screenshots, diagrams, anything transparent). iPhone HEIC photos and WebP images are converted on the way, and photo metadata such as GPS location is removed. Each image's size is recorded, so the app shows it at its own proportions instead of cropping it. Animated GIFs are kept as they are — they play on screen but print as their caption. SVG and Windows metafile (EMF/WMF) images can't be added to content; save them as PNG first.

Inside every bucket, a file's path starts with your agency's id, so each agency has its own folder. Storage lets someone write into that folder only while your agency is active for them and they hold Edit content; the upload buttons follow the same rule, but storage makes the check that counts.

A file and its asset record

Uploading stores the file, then registers it as an asset: a row recording its kind, path, size, original name and, for images, default alt text and caption. That row is what Media lists, what syncs to operators' phones, and where the storage limit is checked.

An asset belongs to at most one content item, or to none, in which case it waits in Media as an unattached file that only staff can see. Attaching it to an item later costs no extra storage. Images placed inside an article are referenced by their path, so Media's used in count looks at where a file appears — in an item's current version and in the version operators have — separately from which item owns it.

Every file in your folders has an asset record. Uploads and library imports register theirs as the file lands, and once a night ROK registers any stored file still missing one (an older upload, say, or a file whose clean-up failed) as an unattached file in Media. So what Media lists and what your storage meter counts are the same files.

How the storage limit is measured

Your plan sets a storage limit for the agency (see plans and limits). It is checked each time an asset record is added, and by then the file is already in the bucket.

The check does not trust the size the browser reported. It adds up the real size of every file in your agency's folders across the four buckets. If the new file takes the total over the limit, the asset record is refused and the console removes the file again, so the refused upload takes up no space. A library import is checked the same way, file by file as it copies.

The storage meters on Billing, in Settings, in Media and on the dashboard show that same total, so a file is refused only once the meter has reached the limit.

Reading a file: signed links

Nobody reads a content file by a plain address. The console and the operator app each ask storage for a signed link: a temporary address that stops working after a set time.

• The console asks for links that last seven days, so previews and Open file in Media keep working through a long editing session.
• The operator app asks for links that last one hour, just long enough to download or stream the file.

Storage issues a link only for files in the folder of the requester's active agency, plus the files published ROK content library items use, which any signed-in agency can read so it can import them. A library draft's files stay private to the library. Once issued, a signed link works for whoever holds it until it expires, so treat a copied link the way you would treat the file.

The public exceptions

Three small buckets are public on purpose, and their files are served at plain addresses:

• Badge artwork (up to 1 MB, PNG or SVG), so a shared credential or badge page opens with no sign-in. Only people with Manage badges can write to your agency's badge folder.
• Agency logos (up to 5 MB), written by people with Manage branding.
• Profile pictures (up to 2 MB), each person writing only to their own folder.

Anyone with the address can view these, so keep anything sensitive out of a logo or badge design.

What the operator app does with files

A sync sends the asset records of published items only; files waiting unattached in Media never reach a phone. After each sync the app fetches every image those items use — attached images, cover and hero images, and pictures found inside article bodies, including older ones with no asset record. PDFs are kept the first time they are opened, and video and audio when the operator asks for them or downloads the whole guide. Files are cached separately for each agency; see how downloaded guides and storage work.

What this means in practice

• Deleting content frees the storage only it used. When you delete items, the files they had attached are removed too, unless another item still uses them (a copy made with Duplicate shares its original's files, for example). Files that are still in use stay, unattached, in Media.
• To reuse a file in a second item, upload it again. An attached file is no longer offered by Choose from library.
• Returning a file to the library stops it syncing with the item it was attached to.