Have something to say?

Tell us how we could make the product more useful to you.

Completed

Deleted files leave source uploads and attachment blobs in storage

When a file is deleted, the database rows are removed and the logs report success, but the underlying objects stay in Cloud Storage indefinitely. Evidence (production, 16 July deletion, still present 20 July) Logs show the full happy path: Attachments cleaned up and unreferenced blobs queued for reap, Starting async PDF cleanup, File deleted successfully. Despite this, thousands of attachment blobs remain under the project's attachments/ prefix in the uploads bucket. The original uploaded source files also remain under the user's uploads/ prefix β€” they do not appear to be removed by the delete path at all. Four days later none of these objects have been reaped. Why it matters This is a retention and data-protection gap, not just wasted storage. A customer who deletes their content β€” often the whole point of a redaction workflow β€” still has the original documents and attachments held on our infrastructure, including personal data belonging to third parties. Deletion must actually delete. Suggested next step Verify the reap queue is receiving rows and is actually being drained, confirm the delete path removes the source upload as well as attachments, and backfill a cleanup for objects already orphaned by past deletions.

Harry Elliott 7 days ago

2

Bugs

Completed

File deletion intermittently returns 500 before eventually succeeding

Deleting a file from a project intermittently fails with a 500 before a later retry succeeds. Observed repeatedly on 15-16 July in production. Evidence One file returned 500 on four consecutive delete attempts, then succeeded. A second file returned 500 twice before succeeding. A third returned 500 twice the previous day. One delete returned 200, and an immediate repeat of the same request returned 404 β€” so the client cannot tell a real failure from an already-completed delete. Why it matters Deletion is a data-protection operation. A customer clearing their own content sees an error and cannot tell whether the data was removed. Repeated retries also mean the cleanup path runs more than once for the same file. Suggested next step Capture the underlying error behind the 500 (the response body is generic), make the delete idempotent so a repeat returns success rather than 404, and surface a clear outcome to the user.

Harry Elliott 7 days ago

2

Bugs

Completed

Blank Pages at the beginning of PDF Exports

Fixed and deployed. Blank pages at the start of an exported PDF were caused by how documents authored in Word/Outlook declare their page layout: it forced a page break that left the document header alone on the first page, with the content pushed onto the next page (and, for multi-section messages such as bounce notifications, over several pages). The exporter no longer honours that author-supplied page layout, so the header and content now start together on page one. Genuine, deliberate page breaks are still respected. Note: this applies to documents processed from now on. PDFs that were already exported keep their existing layout β€” re-exporting the affected documents produces the corrected version.

Harry Elliott 7 days ago

Bugs