Files and storage

Limits

A file is at most 25 MB, and executables and scripts are refused. Each website chat inbox sets which files visitors may send (visitors' files), and channels add their own limits (SMS, Telegram, WhatsApp, Slack). Every download goes through the API, which checks on every request that the person may see the conversation and, for a file marked as personal data, that their role sees that kind of data (security model).

Where files live

On Kommio Cloud the files are stored for you. A self-hosted installation keeps them in a directory on the server (the default), on a mounted share or disk (NFS, SMB, a cloud block volume, a NAS), or in an S3-compatible bucket; the store is a setting, and kommio storage copy moves every file from one store to another while Kommio keeps serving, skipping what is already there, so a second run after the switch picks up what arrived in between and nothing is deleted on either side. The built-in backups copy a directory store incrementally and never delete a file on the backup target. Write to [email protected] for the self-hosting guide.

What happens to an image

Every JPEG, PNG and WebP is rewritten before it is stored, whoever sends it: the agent app, the API, the website chat, email and the other channels, chatbot flows, the help center editor and the Chatwoot importer.

• Metadata is removed. Phones write the GPS position, the device, the time and often an embedded thumbnail (which can show the photo before it was cropped) into every picture, and sometimes a second image or a short video after its end. All of it goes: EXIF, XMP, IPTC, comments, embedded thumbnails and images, PNG text and time chunks, and anything after the image's end. What draws the image stays byte for byte, colour profiles and transparency included, so nothing is re-encoded and nothing loses quality.
• The orientation is kept. A portrait phone photo is stored sideways with a note to turn it; Kommio keeps that one note and nothing else, so photos stay upright.
• Previews are made in the background, 320 and 1024 pixels on the long edge. The thread shows the small one (the large one on high-density screens), the full-screen view the large one and the chat widget the small one; the original is always the download. Until the previews exist, the original is shown. Animated GIFs are left as they are.
• Oversized images are refused for previews. An image of more than 40 megapixels, or one that takes too long to decode, is stored and downloadable but gets no preview.

A file whose structure the cleaner does not understand (a truncated or malformed image) is stored as it came, so nothing is lost, but its metadata is not removed. HEIC, TIFF and AVIF images are also stored as they come. Files stored before cleaning existed are cleaned and given previews in the background, newest first.

Unused files

A file is stored once however many messages carry it, and deleted only when nothing uses it any more: no message, chatbot flow, help center article, brand logo or contact picture. A nightly job finds such files once they are more than a day old and deletes them the next night if they are still unused. Conversation exports, report files and contact import files are kept for seven days; failed uploads for seven days too. Files marked as ID documents can be deleted a set number of days after upload (Settings › Privacy; off by default), and a contact's erasure removes their files and every file marked as personal data in their conversations.

Storage per workspace

Settings › Workspace › Storage shows the workspace's total and a bar by category (people with settings:manage, so Administrators by default). The numbers are kept up to date as files come and go, so they are exact at any moment on any workspace size.

The meter counts a file each time it is used: a file attached to three messages counts three times. Exports and contact import files are temporary and not counted.

GET /account/storage

{ "total_bytes": 734003200, "files": 18214,
  "categories": [ { "category": "attachments", "bytes": 612368384, "files": 18012 },
                  { "category": "previews", "bytes": 98566144, "files": 0 },
                  { "category": "knowledge", "bytes": 21233664, "files": 190 },
                  { "category": "flows", "bytes": 1835008, "files": 12 },
                  { "category": "branding", "bytes": 262144, "files": 4 } ] }

files does not count previews. A CDN in front of the files is not part of Kommio yet.

Virus scanning

A self-hosted installation can have every file scanned by ClamAV before it is stored. It is off by default, and Kommio Cloud does not scan files yet. With a ClamAV daemon set up (KOMMIO_CLAMAV_ADDR), every file that enters Kommio is scanned, whoever sends it: the agent app, the API, the website chat, email and the other channels, chatbot flows, the help center editor, logos and the Chatwoot importer.

• A flagged file never reaches the store. An upload by a person is refused with 422 naming the signature. A file that arrives on a channel is replaced by a placeholder on the message: the thread and the website chat show "File removed: flagged by the virus scanner" with the file's name, and the removal is in the audit log.
• When the scanner is slow. A file the scanner gives no verdict on within ten seconds is stored and scanned shortly after; if it is flagged then, every message that carries it shows the same placeholder and the file is deleted. Downloads and previews of a removed file answer 410 Gone; exports list it as removed, and it is never sent to an AI provider or a channel.
• Fail-open, on purpose. A file without a verdict is served as before, and nothing is refused because the scanner is down, so a broken scanner never stops customers' files from reaching agents. The operator sees files waiting for a scan and scan errors in the platform console. Files stored before scanning was switched on are not scanned afterwards, and nothing is scanned on download.

Each attachment in the API carries scan_state: clean, infected (with scan_signature and no link), pending, error, skipped (scanning off), or empty for files from before scanning existed. Ask [email protected] for the self-hosting guide, which describes running the scanner.