Public and Private
Uploads go to one of two configured locations, and the choice decides whether the file has access control.
Where to find it
Architect Panel → Configuration:
- Site Settings — the File Uploads and Audio/Video Conversion groups
Architect Panel → Data:
- File Stores — the stores themselves, and View File Store on a row
- Large Uploads — in-progress and stalled upload sessions
- File Import Routines — watched sources and their mappings
The difference
- Public — served directly by the web server. Anybody with the address has the file.
- Private — outside the served directories, reachable only through the platform, which checks permissions first.
“Unguessable” is not access control
The reasoning that puts sensitive files in public directories. A long random filename is not a permission — it is shared in an e-mail, appears in a browser history, is indexed if a link exists anywhere, and never expires.
Files that should be restricted go in the private location. There is no version of this argument that works.
The rule
Private unless the file is genuinely intended for anybody. Logos, public documents, marketing images and site assets are public. Everything a user uploaded, everything attached to a record, and everything about a person is private.
Public is faster
Which is the legitimate reason for it. A file served directly does not involve the application, so site assets belong there for performance as well as simplicity.
Check what is where
Public directories accumulate things nobody meant to publish — a file placed there during setup, an export saved for convenience, an attachment written to the wrong location.
Listing what is in your public directory is a short and occasionally alarming exercise.
Moving a file changes its address
So anything already linked breaks. Decide before files are stored rather than after, and remember that if you move something from public to private, existing links stop working — which is the point, but somebody will report it as a fault.
Test as somebody with no access
Take the address of a private file and open it in a private window with no session. It should refuse. That is a two-minute test and it is the only proof.
Backups and copies follow the same rule
A private file copied into a public directory for a migration, or an export written somewhere convenient, has left its protection behind. Those copies are where disclosures come from.
Worked example
An organisation keeps only site assets in its public directory and everything else private. A review of the public directory found three exports left there during a migration two years earlier, one containing customer names, which were removed.
Recommendations
- Private unless genuinely public.
- Never rely on unguessable names.
- List the public directory periodically.
- Test a private file from a session with no access.