File types you can attach

You can attach files in two places: the original PDF of a policy, and appendices, forms and templates. Pictures in text are covered in Pictures and links.

Who can do this: Managers and administrators; Administrators only.

Accepted #

The size limit is 10 MB per file.

Refused #

• Files with macros, including .docm, .xlsm and .pptm, and any Word, Excel or PowerPoint file that contains macro code. Macros can run programs on the reader's computer.
• Web pages and programs such as .html, .php, .js and .exe.
• Images as attachments. Put pictures in the text of a part or a written appendix instead.
• Anything bigger than the limit, or empty.
• A file that is not what it claims to be. Policy Core opens the file and checks what is inside, not just its name. A text file renamed to .docx, or a web page renamed to .pdf, is refused with "That file is not really a DOCX file".

How files are stored and served #

• Files are kept privately under random names. They cannot be reached by guessing an address.
• Only people signed in to your organisation can open them. Staff can open only the files in the version of a policy that is in force; managers can open any revision.
• Files are served exactly as uploaded, and in a way that stops a browser treating them as something else.
• Policy Core does not scan files for viruses. Upload files you made or trust.

Tips #

• For a form people complete on a computer, upload the editable Word or Excel version.
• For a form people print, upload the PDF.
• Give the file a clear name: it is shown to readers. "Incident report form 2026.docx" is better than "final_v3.docx".
• Where you can, write it in Policy Core instead. See Adding appendices, forms and templates.