Skip to content
React Box

The vault

Documents

A document is the unit of exchange in the vault. It bundles a name, a status, one or more files, tags, comments, and a complete activity log.

Updated on August 14, 2026

Anatomy of a document

Six fields structure every document. All of them are visible in the side panel when you open a document.

  • Name

    The title you see in the list. Editable at any time, except when the status is locked.

  • Status

    The processing step. Six possible values, detailed on the "Statuses & workflow" page.

  • Folder

    The folder where the document lives. You can move it from one folder to another.

  • Files

    One or more attached files. You can add, remove, or replace them as long as the status is not locked.

  • Tags

    Your custom labels. Optional, but useful to find a document months later.

  • Comments

    A discussion thread attached to the document, shared between the business and its agency.

Files

Attached files are stored in a private Cloudflare R2 bucket, accessible only via short-lived signed URLs.

Constraints

  • Maximum size per file: 20 MB.
  • Accepted formats: PDF, images (JPEG, PNG, HEIC, WebP), Office documents (Word, Excel, PowerPoint), plain text, and CSV. Any other format is rejected.
  • When the status is locked (Pending, Action completed, Rejected, Processed), no file can be added or removed. Move the document back to draft to edit it.
  • The file's actual content is verified at upload to make sure it matches the declared type. A PDF renamed as .jpg will be rejected.

How upload works

The file is uploaded directly from your browser to Cloudflare R2 via a pre-signed URL. React Box never relays your file through its servers. Once the upload completes, the application only records the reference (R2 key, original name, size, type).

When the agency uploads a file

A member of the accounting firm can also attach files to a document (processing evidence, accounting entries, letters). These files are flagged as coming from the agency and show up as such in the activity log.

Comments

Every document has its own discussion thread. Comments are visible to everyone who has access to the document — your internal collaborators as well as members of the accounting firm linked to your client file.

Activity log

Every action taken on a document is recorded. The log serves as a complete audit trail: who did what, when, on which document.

  • DOCUMENT_CREATED

    Document created.

  • FILE_UPLOADED

    File uploaded.

  • FILE_DELETED

    File removed.

  • STATUS_CHANGED

    Status change, with an optional note.

  • TAG_ADDED

    Tag added.

  • TAG_REMOVED

    Tag removed.

  • COMMENT_ADDED

    New comment.

  • DOCUMENT_MOVED

    Moved to another folder.

  • DOCUMENT_RENAMED

    Document renamed.

  • VISIBILITY_CHANGED

    Visibility rules changed.

  • DOCUMENT_DELETED

    Moved to the trash.

  • DOCUMENT_RESTORED

    Restored from the trash.

Controlling what the agency sees

By default, every document is visible to your linked accounting firm. Two levers let you restrict that visibility case by case.

  • Hide from agency

    Ticking this box makes the document entirely invisible to members of the accounting firm. Useful for sensitive items that don't need processing (NDAs, confidential HR records).

  • Limit to given roles

    You can restrict access to specific internal roles only. Other users in your organization won't see the document.

These settings are visible in the activity log: a VISIBILITY_CHANGED entry appears on every change.

Sharing a document by link

For a recipient with no React Box account — a bank, a notary, an auditor — a secure public link replaces the email attachment.

  • Expiry — one day, seven days, thirty days, a date of your choosing, or no limit. A dated link expires on its own, which an email never does.
  • Password — optional, to be shared through a channel other than the link itself.
  • View only — the recipient reads the document in their browser without being able to save the file.
  • Notify on access — you learn when the link was first opened.

Every link you create stays listed on the document, with its status, its expiry date and the number of views and downloads. You can copy it, email it to several recipients from React Box, or revoke it: revoking cuts access immediately, even for someone who already holds the link.

The public page asks for an anti-bot check before opening the document, and exposes nothing else — neither the vault nor any other record.

Associated permissions

Two permissions govern document usage.

  • document:view — read a document and its files.
  • document:manage — create, edit, move, delete a document. Includes document:view.