Working with attachments

In one sentence

Every regulated record — NCR, MOC, audit, FMEA, JHA, risk, exemption, meeting, supplier, client, product — has an Attachments tab where you upload supporting files, give each one an optional description, and archive them when they're no longer current without losing them from the record.

Uploading a file

The Attachments tab has a dropzone at the top — drag a file in, or click to pick from your file system. The upload shows progress and lands the file under the record once complete. File size is shown alongside each row so you can keep an eye on your org's storage.

Multiple files at once is fine — drop them in and each one uploads in parallel.

The description field

Once a file is uploaded, you'll see an Add description link next to its filename. Click it, type a free-text description, save. The description renders below the filename from then on. A pencil icon next to a saved description lets you edit later; the Add description link reappears if you clear it back to empty.

When does the field earn its keep?

• Photos and screenshots — "Caliper at 0.0245 mm against the 0.025 mm minimum spec" is more useful than "IMG_4729.jpeg".
• PDFs and spreadsheets — "Supplier 8D report for NCR-2026-0418, received 14 Mar from Northwind Hydraulics" tells the next reader what they're opening without downloading first.
• Generic captures — "Before / after the spec change", "Customer-supplied drawing rev 3", "Audit Day 1 closing-meeting whiteboard".

Descriptions are optional — existing files from before the field was added show No description in italics and a fresh Add description link. Nothing breaks; nothing is forced.

Archive — keeping evidence without cluttering

When a file is superseded — a newer revision uploaded, a temporary capture no longer needed — archive it rather than deleting. Archived files:

• Drop out of the main attachments list.
• Stay attached to the record for the full audit trail.
• Surface in an Archived section on the same tab, expandable when you want to see them.
• Can be restored to the active list anytime.

The pattern keeps the active surface clean without losing evidence. For regulated records, that's a meaningful distinction — "we removed this file" and "we archived this file" are different inspector answers.

Deleting an attachment outright is also possible when the file genuinely shouldn't have been uploaded (wrong record, sensitive content). Delete is permission-gated and captured in the record's History tab.

Read-only behavior

When a record is in a locked state — Closed NCR, Approved document, Closed meeting — the Attachments tab goes read-only. You can still:

• View every attachment, current and archived.
• Click through to download.
• Read descriptions.

You can't:

• Upload new files.
• Edit or remove existing descriptions.
• Archive or delete attachments.

Reopening the record (where the module supports it) re-enables the affordances. The lockdown matches the rest of the record — once the trail is signed, files on the trail stay where they are.

Storage and access

Each file lives in object storage under a path that's scoped to your organization and the parent record. Two consequences worth knowing:

• Tenant-isolated. A file uploaded against an NCR in your org is reachable only by users who can access that NCR — same RLS rules as the record itself.
• Travels with the record. If the record is restored from Trash, attachments come back with it. If the record is purged after the 90-day window, the storage gets cleaned in step.

For external-document files specifically, the storage bucket is locked tighter — see External documents for the immutability rules on approved-version PDFs.

The audit trail

Every upload, description edit, archive, and delete is captured on the record's History tab as an Activity entry with the actor's name and timestamp. So "who uploaded this evidence and when?" has a permanent answer separate from the file itself.

For inspector-grade evidence packs, the Record history print export lists every attachment lifecycle event chronologically alongside state transitions and field changes.

Related

• Record history — where attachment events are logged
• External documents — the dedicated controlled-document attachment surface
• Trash and Soft-delete — what happens to attachments at delete and purge
• Access control — how attachment visibility follows record access