Feature
Media library
A workspace media library that tracks more than files. Every upload is hashed server-side, scanned for malware, and processed into registered renditions; usage rights and subject consent are recorded per asset; and the publish worker re-checks all of it at dispatch, so an asset with expired rights, withdrawn consent, or an unfinished scan never goes out.
What the library does
Assets, rights, and consent in one record.
Direct and multipart uploads
Files upload straight to private object storage through presigned URLs. Files of 5 MB or more use multipart upload, and completion requires every part's number and ETag.
Server-side SHA-256
After upload, the worker streams the stored object and computes its SHA-256. A checksum sent by the browser is never trusted; a mismatch is recorded on the asset. Because approvals bind to rendition hashes, a changed file invalidates the approval.
Malware scanning before use
Assets are scanned by a ClamAV-based scanner service. Infected files are marked failed and quarantined. If no scanner is configured, the asset stays pending and can't be published; it is never assumed clean.
Renditions for video
Video is transcoded to an H.264 MP4 rendition (720p by default, with a 1080p profile available). Each rendition is registered with its own SHA-256, dimensions, and duration alongside the immutable original.
Usage rights records
Owners and admins record the rights basis, licensor, license reference, territories, permitted channels and uses, restrictions, and expiry for an asset. Revoking rights requires a reason and is audited.
Subject consent, including minors
Consent records capture the subject, consent type, channel and use scope, and expiry. An asset depicting a minor can't be recorded without guardian consent, and consent can be withdrawn at any time.
Drive and Dropbox import
Import from Google Drive through the picker or from Dropbox through Chooser links. The picker token is encrypted while the job runs and scrubbed afterward, and imported files are hashed and scanned like uploads.
Alt text, licensing notes, and usage
Edit filename, alt text, licensing notes, folder, and metadata. The library shows size, dimensions, where each asset is used, license, expiry, and processing status, with filters by type, status, and workspace.
How it works
From upload to a publishable asset.
1. Upload
Request an upload URL (or a multipart upload for larger files). The asset is created in the workspace as pending, with its scan status pending too.
2. Hash and register
On completion the worker computes the SHA-256 from storage and registers the original rendition under that hash.
3. Scan
The scanner downloads the object over an SSRF-guarded connection and returns clean, infected, or failed. Only clean assets continue.
4. Transcode video
Video goes to the transcoder, which writes an H.264 rendition and returns its hash and probe metadata. Images are ready once the scan passes.
5. Record rights and consent
Add a rights record unless the asset is owned, and a consent record for anyone identifiable. Each is scoped to channels and can carry an expiry.
6. Final preflight at dispatch
Right before a post is sent, the worker checks that every rendition is registered, not deleted, scanned, and processed, that rights cover the channel, and that consent is current. Any failure holds the post with MEDIA_NOT_READY or RIGHTS_BLOCKED.
Safeguards
What the publish path will not do.
Drop media silently
The worker sends the complete approved media list in order, with alt text and options. If a provider would drop media, the post fails or holds instead of going out as text only.
Publish a deleted asset
Deleting an asset marks it deleted rather than erasing it, so published records and usage history stay intact, and any not-yet-sent post that uses it is held.
Lose provenance on migration
Migrated assets keep their original provenance and verified hashes; an import manifest whose hashes changed after export no longer verifies.
Limits
Import and storage limits.
Cloud imports take up to 50 files per job and up to 100 MB per file. Storage by plan: Starter 25 GB, Agency 100 GB, Scale 500 GB, Command 1 TB, Enterprise custom. Rights and consent changes are limited to owners and admins.
Who relies on it
Built for teams that have to prove they could post it.
Agencies
Keep each client's licensed stock, shoot assets, and talent releases in that client's workspace, with expiry dates that stop publishing automatically.
Brand teams
Record territory and channel limits on licensed media so an asset cleared for one network can't be scheduled to another.
Creators
Import from Drive or Dropbox, add alt text once, and see every post an asset was used in.
Nonprofits and schools
Record guardian consent for minors and withdraw consent on request; posts that use the asset are held before they are sent.
Product limits
Media limits at a glance.
- Multipart upload
- 5 MB+
- Files at or above this size upload in parts
- Cloud import
- 50 files
- Per Drive or Dropbox import job
- Imported file size
- 100 MB
- Maximum per imported file
- Video rendition
- H.264 MP4
- 720p default, 1080p profile available
FAQ
Frequently asked
What happens when usage rights expire?
Rights records carry an expiry. At dispatch the worker looks for a current, unrevoked rights record that covers the channel; if there isn't one, the post is held with RIGHTS_BLOCKED. Assets marked as owned don't need a rights record.
How do you handle photos of minors?
A consent record for a minor can't be saved without guardian consent, and any asset whose consent is withdrawn or expired is blocked from publishing.
Are uploads scanned for malware?
Yes. Every asset goes through the scanner before it can be used. Infected files are quarantined, and if scanning is unavailable the asset stays pending instead of being treated as clean.
Which import sources are supported?
Direct upload, Google Drive (via the picker), and Dropbox (via Chooser direct links). Each job takes up to 50 files of up to 100 MB each.
How much storage do I get?
Storage depends on the plan: Starter 25 GB, Agency 100 GB, Scale 500 GB, Command 1 TB, Enterprise custom.
What isn't supported?
Automatic detection of faces or minors, imports from sources other than Google Drive and Dropbox, and imported files larger than 100 MB aren't supported. Rights and consent are recorded by a person.
Media with receipts
Know every asset is cleared before it's posted.
Upload a few files and record rights and consent in a real workspace.