Where files go
Uploaded proofs are stored at wp-content/uploads/approvaltrail/{year}/{month}/{proof id}/{random}.{ext}, never in your media library, and never under a filename your customer chose. The directory carries deny rules for both Apache and IIS, and Site Health actively probes whether a file in it can be fetched directly over the web, rather than assuming the deny rule is respected. This matters because nginx ignores .htaccess entirely, so a shop on nginx needs a server-level rule instead. See Troubleshooting for the exact block to hand your host.
Files are only ever returned through an authorized download route — never served directly.
What’s accepted
PDF, PNG, JPG, GIF and WEBP by default. SVG is off by default and opt-in (see Settings) because an SVG is a script-capable document. Accepting one widens what a malicious upload can do.
Every upload is checked two ways: against the file-type allow-list, and independently sniffed to confirm the file actually is what its extension claims. A PHP file renamed to .pdf is rejected at upload, not discovered later.
Previews
After a file is uploaded, a downscaled preview generates in the background. Your customer’s download link serves that preview by default — not the original master file. Two reasons for that:
- An unverified original file is never the default thing served on a public, token-authorized route.
- A 200 MB master file is never the default bandwidth bill on every customer click.
The full master remains available; it’s just not the default. PDF previews need Imagick with Ghostscript available on your server. Where that isn’t available, the master is served instead: a missing preview should never mean a dead link for your customer.
Large files
Above roughly 20 MB, uploads are sent to your server in pieces, with a progress bar so a large print-ready file doesn’t die to a server timeout partway through. The assembled file goes through exactly the same type and content checks as a small one: chunking doesn’t relax validation. Abandoned in-progress uploads are automatically cleared after 24 hours.
Retention: the part worth reading carefully
After a decision is made, master files older than your retention window (default 90 days; 0 means never release them) are released to reclaim disk space.
What’s kept, always, regardless of retention: – The preview image – The file’s SHA-256 fingerprint – The version metadata – The entire decision record
Each release is itself written into the record as its own entry, so nothing about it is hidden after the fact.
So: your disk usage goes down. Your proof of approval does not. That’s the sentence to hold onto if you’ve been putting off turning retention on because you were worried clean-up meant losing your evidence — it doesn’t.
The storage meter
On the Settings screen, a running meter shows: what’s currently on disk, what retention has already released, and your server’s own upload ceiling (the real limit — ApprovalTrail’s own upload-size setting can only sit below it, never above).