Files and what you sent¶

Two different things live here, and the difference matters.

Files you already had¶

Documents → Files

Upload PDFs, Word documents, certificates, portfolio pieces — anything written outside Postulo. A CV a designer made for you belongs here, not in the CV builder. The list can be narrowed to one kind of file, as the letters are; only kinds you hold a file of are offered.

Versions. When you upload a replacement, name the file it supersedes. Postulo numbers the new one automatically and keeps the old file: superseded versions are shown greyed out rather than deleted. You applied with that old version, and the record of what you sent has to stay true.

The upload limit is 20 MB per file.

What it is, not only what it is called. The types an upload may be are PDF, DOC, DOCX, ODT, RTF, TXT, PNG and JPEG, and a European Digital Credential (JSON or JSON-LD, below). A file is also read for what it should start and end with: a PDF begins %PDF- and ends %%EOF, a PNG or JPEG decodes, an ODT lists a mimetype entry first and a DOCX a [Content_Types].xml, an RTF begins {\rtf, a DOC has the OLE2 header and plain text holds no NUL byte. Nothing opens the file with a document library, and the bytes are kept as they came. A file that is not what its name says is refused with a sentence saying what it was expected to be. A .json or .jsonld file is accepted only if it holds a verifiable credential; any other JSON is refused.

A photograph loses where it was taken. A scan that is really a phone's photograph carries its GPS position, the time and the camera, and the file is attached to mail you send to an employer. The upload form therefore has a box, ticked unless you untick it, Remove the photo's metadata (location, time, camera). It cuts that out of a PNG or JPEG by the file's structure, without re-encoding, so the picture is the same pixels and loses no quality; a photograph taken sideways keeps only the turn that shows it upright. Untick it to keep the file exactly as it is. PDF, Word and OpenDocument files keep whatever they carry, such as an author's name.

Say which language it is in. The upload form asks, and leaves the answer blank until you give one: Postulo has never read the file, so it does not guess. A file whose language nobody has stated says language not said on the list, which is a prompt rather than a complaint — nothing else depends on it, and a German certificate is better unlabelled than labelled English. Once said, the flag stands beside the file wherever it appears, and the answer travels with any copy sent to a store.

Certificates, diplomas and diploma supplements. Three kinds are for a proof somebody else issued: Certificate, Diploma and Diploma supplement. A supplement is a second document beside the diploma, not a version of it, so it is uploaded as its own file. For these three the form asks It proves: which education or certification entry of your career record the file is the proof of, chosen from your own entries ("BSc Computer Science, University of Aveiro"). A diploma and its supplement point at the same entry; an entry may have several files; a file proves at most one entry. It is optional, because a scan often arrives before the entry exists. The Files list says which entry a file proves, and a link on the career page narrows the list to the files of one entry. Deleting the entry keeps the files and clears the link; deleting a file leaves the entry as it was. Nothing of this prints on a CV, and the candidate file does not carry it, while your full export does. Each of the three kinds has its own switch on a store connection, on like the others.

European Digital Credentials. A university or training provider may award a qualification as a European Digital Credential: the file the Europass wallet gives you, ending in .json or .jsonld, sealed by its issuer or not. Upload it as a Certificate, a Diploma or a Diploma supplement; it cannot be filed as any other type. It is kept byte for byte, because the seal covers the exact bytes: Postulo never reformats it, and its checksum is that of the file you uploaded. It downloads, and goes to a store, like any other file.

The seal is not checked. The Files list and the API say Seal not checked by Postulo beside every credential, in grey. Postulo does not say a credential is valid, verified or authentic; to check one, open it in the Europass EDC Viewer yourself.

What it says is shown beside it. The file's edit page shows What this credential says: its title, who awarded it, when, and its EQF level where it states one (a certificate of participation usually states none, and none is guessed). It is read from the file each time the page is shown, in your language where the credential has it and otherwise in English; nothing is fetched to read it, nothing is sent anywhere, and nothing is kept beside the file. The credential also holds your name, date of birth and identifiers; those are not read. The reading is done by Europass import: with that plugin off, the file is kept and labelled, and nothing is read from it.

Only the current format. Since 2023 credentials are JSON-LD (European Learning Model 3). An older credential in XML is refused with a sentence saying to download it again from your Europass wallet, where it has been converted.

Reference letters¶

A reference letter is a letter somebody wrote about you, which you hold and attach to applications. It is not the same thing as the people who will vouch for you on your career record: those are people, this is a document. They share a contact and nothing else.

Upload it as a file of type Reference. The form then asks for what Postulo cannot read from the file:

• the referee, one of your contacts (who need have no company), or a name typed under Or a new contact, which adds them to your contacts;
• the date it was written, and a date it should not be sent after, both optional;
• how it reaches the employer: you send it, or the referee sends it themselves.

The not after date is yours and is never enforced. Record what you sent names the referee and the date beside the file and says when the date has passed, and still lets you attach it. A letter the referee sends themselves is not offered as a file to attach; it is listed under the choices as to be sent by them. On an application's documents page the letters sent with it have a group of their own, with the referee named. A contact's page lists the letters they wrote and the applications each went with, and a search for their name finds the letter.

The referee's rights. A letter is data about the person who wrote it. The export of one contact lists their letters and the applications they went with. Deleting the contact asks what to do with the letters: by default they are kept, without a referee, and the erasure says how many; tick the box and they are deleted with the contact. Only the letters you hold are counted and deleted: on a contact shared with others, theirs stay theirs, and they keep a copy of the contact. Merging two contacts moves the letters to the one you keep. The same contact may also be one of your references, the people who will vouch for you: the export of the contact lists that entry (version 6 of the document), the erasure deletes it and says so, and a CV you already sent keeps the words it was sent with.

Copies to a store. A new store connection has the switch for Reference off, because the letter is somebody else's words and name. Turn it on if you want them archived. A connection made before this keeps the setting it had, which was on.

What you sent¶

Documents → Sent documents

Whenever you export a CV, download a report, or record what you sent with an application, Postulo stores:

• the PDF exactly as it was rendered at that moment,
• the text it was built from,
• for a CV, its words without the layout, and
• a checksum of the file.

These are never regenerated. Edit the CV afterwards as much as you like; the snapshot does not move.

This is the feature you will not appreciate until an interviewer asks about something on your CV three months and eleven revisions later. The stored text matters as much as the PDF, because a PDF is awkward to search and impossible to compare — and two versions of a CV or a letter can be compared: see Comparing two versions.

A draft is not here. Download draft PDF on a CV or a letter hands you the PDF and keeps nothing, so looking at where a page breaks does not file a version. The same goes for a CV copied as text or downloaded as a Word file.

An export is kept once per version. Exporting a CV that has not changed since it was last exported hands you the version already kept. Before it does, Postulo checks that the file it kept is still the file it rendered, against the checksum; one that has gone missing or been changed is not handed back, and the export is drawn again.

Exported on its own in the Sent with column means the PDF went with no application. Each one also says whether it was written with its properties (the author and the rest) or without them, because the copy that is kept is the one that was sent; see What the file says about itself.

One whose application has since been deleted says where it went instead, in the words written down on the day.

To record a set: open an application and choose Record what you sent. Pick a CV, a cover letter and any files you already had. Postulo renders the first two as they stand, attaches everything to the application, and notes it on the timeline.

If you have an outbox connection, the page can also email the chosen CV, letter and uploaded files from your own address. The email is sent first. If it goes, the same PDFs that were attached are the ones frozen, and the application's timeline records Documents emailed with the address; if it fails, nothing is frozen or recorded and you can correct and retry. Links are recorded but are not added to the email.

A snapshot outlives what it was sent with. Delete the application, the listing or even the whole company, and the PDFs stay where they are, still naming the role and the employer they went to. That is the point of a snapshot: the evidence is not a side effect of the records around it. Deleting any of those does say, before it happens, how many applications, timeline entries, interviews and reminders go with it — and how many sent documents are kept.

A snapshot keeps the language it was sent in. It is frozen with the PDF, like the text and the checksum, and for the same reason: the CV it came from can be rewritten into another language afterwards, or deleted outright, and what an employer received is still what it was. A report is kept in the language you were reading Postulo in when you pressed Download, because that is the language it was printed in.

An uploaded file cannot be swapped. Once a file is here, its bytes never change: editing it changes the title, the kind and the notes only. A new version is a new upload that marks the old one as superseded, so an application that says it sent something still means the file it actually sent. Every upload is checksummed when it arrives.

Links you pointed them at¶

Not everything you send is a file. A portfolio, a profile or a video CV is an address, and those live on your career record as links. Record what you sent offers them beside your CV, your letter and your files, and the ones you tick are attached to the application and named on the timeline. A link that did not answer when it was last checked says so wherever it appears.

Keeping copies elsewhere¶

Everything above lives in Postulo's own private media, and always will: that is where rendering, downloads, the export and the review of what you sent read from, and none of it needs a network. A document store is somewhere that receives copies — a Paperless-ngx archive, say, through the postulo-paperless plugin.

Once the operator has installed a store plugin, add it under Settings → Connections. The form ends with a switch per kind of document — CV, cover letter, certificate, portfolio, report, reference, other — so you can send the paperwork and keep the rest at home. An email is not a kind, deliberately: what is worth keeping of one — the text as sent, frozen — is what a letter's snapshot already is, and a message a transport carries is not a document. From then on a store is sent what was handed over: every file you upload, every CV and letter recorded as sent with an application, and every report. The scheduler sends each on its next pass, a few minutes later. A PDF exported on its own stays here: it went to nobody, and it used to fill an archive with every try at a layout. It is kept in Postulo like any other version, can be downloaded, and says Kept here only where a copy's state would be. Each document that does go shows how that went, beside its name:

• archived — with a link to it in the store, when the store has one;
• waiting to be sent — the scheduler has not been round yet;
• failed: … — with the reason; Postulo tries again with a growing wait, six times, then leaves it to you;
• not accepted — the store declined that kind of document.

Send to stores now under a document tries at once, and gives a copy that gave up its attempts back. Send everything on the connection queues what you already had before the store existed, by the same rule: what went with an application, reports and files, and not the PDFs exported on their own. Nothing is ever sent twice to the same store, and nothing is ever deleted from a store: an archive is for keeping.

The references — where each copy went — travel in your export, so a restored instance still knows where its copies are even before you recreate the connection.

Each copy is filed under the language of the document, never the language you happen to read Postulo in — a French CV archived as English is a French CV you will not find again. A file nobody has stated a language for is sent without one, and the store files it by its own rules.

Upgrading. This changes what a store is sent from now on, and nothing a store already holds: a copy of an export that arrived before this release stays in the store and stays listed beside its document, and nothing is ever deleted from a store. What is withdrawn is the queue — a copy of an export that was still waiting to go, or had failed and was waiting to be tried again, is no longer sent.

Privacy¶

Uploaded documents contain your address, your phone number and your full employment history. Postulo treats them accordingly:

• Media is never served by the web server. Files are delivered only through a view that has already established who is asking. A file belonging to someone else is not merely refused — it is not found.
• Downloads are sent with Cache-Control: private, no-store, so they do not linger in a shared cache.
• Stored paths are checked on every request to confirm they resolve inside the media directory.
• Deleting a document deletes its file, once the change is committed and no other record points at the same file. "Deleted" means deleted, not hidden.

Documents deleted before that was true left their files behind, and a restore from an older archive can bring more. To find them:

uv run manage.py prune_media              # lists what no record points at, deletes nothing
uv run manage.py prune_media --remove     # deletes those files

It lists by default because the failure mode of the other default is somebody's CV. Files that a record points at are never touched. (Until the release after the one that moved pictures into the database, a profile picture or a logo that was a file is still pointed at by its old field, and so is not listed.)

Orphans, damage and the scheduler¶

• A file nothing points at is removed by the scheduler once it is older than a grace period (24 hours; POSTULO_MEDIA_SWEEP_GRACE_HOURS), so a request that failed after its file was written does not leave it behind, and a request about to attach one is not robbed. Switch it off with POSTULO_MEDIA_SWEEP=false; prune_media stays manual and lists first. Importing an archive that fails half way removes every file it had written.
• Damage is found, never deleted. Each upload keeps its size and SHA-256 from the day it arrived, and the archive carries both (format 54). Every scheduler pass reads a slice of uploads, the least recently checked first; uv run manage.py verify_media reads all of them and every snapshot, and lists files that are missing, changed or unnamed. A damaged file may be the only copy of somebody's diploma, so it is kept and the row says This file is missing or no longer matches what was uploaded on the Files page: upload it again as a new version that supersedes it. Server settings → Overview counts them.
• Nothing leaves unchecked. A restore measures each file against the archive's size and checksum and restores the row without a file that differs, saying so. A copy for an external store is compared with the record first and is not sent if it differs; the copy says why.

What a storage backend has to provide¶

Local media stays the source of truth, and external stores receive copies. The code that touches the bytes asks one module, documents/filestore.py, and no longer the directory: delivering a file, prune_media, deleting an account, the backup and the overview's figures. A backend that replaced the local directory would have to give Django's Storage API (open, save, delete, exists, size, listdir, get_modified_time); path is optional, and without one the application streams the bytes and no proxy is handed a path. The backup alone needs a directory to tar. Nothing of this is published to plugins until one needs it.

If you put a reverse proxy in front of Postulo, do not add a location block serving MEDIA_ROOT. It would bypass every one of those checks. If you want the proxy to do the work of sending bytes, use POSTULO_MEDIA_ACCEL_PREFIX instead, which hands over only after Postulo has authorised the download. See Configuration.

Your picture and a company's logo are not files¶

Two pictures are kept in Postulo's database rather than as files: your profile picture (the one you uploaded, and the copy of your Gravatar if you chose to use it) and a company's logo. Each is at most 1 MiB once re-encoded (a vector logo at most 512 KiB), belongs to exactly one account, and is answered by Postulo itself after it has checked whose it is.

What that means for you: a picture goes with what it belongs to. Delete a company and its logo is gone in the same moment; delete your account and your picture goes with it, however the account was deleted, an administrator's deletion from Django's admin included. Removing a picture, or replacing it, leaves nothing of the old one behind. Documents, the copies you sent, kept pages and exports are still files and are still deleted with their records, as described above.

Nothing changes in how you use them, and the export archive still carries both as files under media/, so an archive from an earlier Postulo imports as before.