Storage Quotas & Upload Limits: Evidence Needs a Meter

ITAD evidence is file-heavy: photos, certificates, signed documents, reports, support attachments, evidence packages. Storage cannot be invisible forever. At some point, the platform needs to know how much a tenant uses and what happens at the limit.

What counts

Tenant storage usage covers operational files in Supabase Storage: documents, photos, signatures, evidence and related uploads. Avatars live separately. Usage rolls up per tenant so package limits and admin storage views can talk about the same number. The package sets the quota — 0 GB on free, 5 GB on starter, 25 GB on professional, unlimited on enterprise — and a platform admin can override it per tenant when the contract says something else.

Warnings

The platform checks usage against the quota on a schedule and sends a storage warning when a tenant crosses 80, 90 and 100 percent, once per threshold. That gives admins time to review usage, upgrade the package or clean up legitimate mistakes. Evidence should not fail because nobody noticed the meter blinking.

Upload blocking

When a tenant exceeds quota, new uploads are blocked on guarded paths with the block name storage_limit_exceeded. The block is explicit: the user sees that storage is the problem instead of a mysterious upload failure. Mysterious upload failures are how support queues grow teeth.

Admin view

/admin/storage gives platform staff the cross-tenant picture: total bytes and document count, tenant count, per-tenant usage with quota editing in GB, the largest files, a file-type breakdown, bucket overview and a growth and cost projection. The storage settings live on the same page — maximum file size in MB, signed-URL expiry, allowed MIME types and the TTLs for photos, documents, evidence and ESG files. Storage health lists unlinked document records, orphaned files and missing files, loading rows in bounded steps up to 200, and a cleanup action removes those three categories of debris. Tenant billing settings show the tenant-facing package context. Together they connect technical storage with commercial limits without turning every PDF into a finance debate.

The purge

Per tenant there is a “Purge storage” action, and it is a real offboarding tool, not a placeholder. Only a platform owner can run it; every other platform role gets a server-side refusal and nothing is deleted. The dialog first loads a preview of exactly what would go — unlinked document records, missing-file records and orphaned objects, with counts — then asks for the exact organization name, and only enables the red button when there is something to purge and the name matches. Documents with a living business record are not counted and not touched; the purge removes storage debris, not evidence. The outcome is written to the activity audit fail-closed, with the counts; if the log cannot be written, the purge does not happen. There is no undo. Preview, name, button, row. In that order, every time.