Where uploaded PDFs are stored

A signing envelope is not a floating form. It is a stored PDF plus the marks you place on it. When you upload from Documents → new, Inkpacket keeps that object on the envelope. Preview reads it. The signer reads it. The completed file is a second object stamped with the values they submitted. This guide is where those bytes live, what upload rejects, and what Drive archive does not replace.

Desk help is Docs. The five-minute send is send a document for signature in under five minutes. After they finish, the stamped PDF and audit is the filed copy. Ask Inkpacket for how file storage works if you are already on the desk.

The object on the envelope

Upload a PDF at /desk/documents/new or start from a workspace template that already has one. Preview pages in the field editor on that document. Download the original or the completed file from the same envelope. The Documents list is /desk. Nothing about that object leaks across organizations.

Settings shows File storage as S3-compatible when S3_BUCKET, S3_ACCESS_KEY_ID, and S3_SECRET_ACCESS_KEY are set. Optional S3_ENDPOINT points at an S3-compatible host. Otherwise Local fallback — uploads still work. GET /api/v1/health reports storage.configured and storage.backend. The desk does not pretend a missing bucket is a cloud archive.

What upload rejects

• Empty uploads return Upload a PDF file.
• Non-PDFs return Only PDF files are accepted.
• Unreadable bytes return This file could not be read as a PDF.
• Files over 15 MB return PDF must be 15 MB or smaller.

A missing object later returns The PDF could not be loaded from storage. A zero-byte stored object returns The stored PDF is empty. An unreachable bucket returns File storage is unavailable. Re-upload a valid PDF. Signers who see Could not load the PDF should refresh; if it persists, the sender opens the envelope and confirms the file.

Drive archive is not the upload

Google Drive archive is a completed-packet export, not the place the draft PDF lives. In Settings you can turn it on and store a folder id. When an envelope completes, Inkpacket uploads the stamped PDF and a JSON audit export to that folder — if credentials exist. Without them Settings and the desk report Drive not configured and do not pretend the upload happened. FAQ matches that skip.

Do not treat Drive as your only copy. The envelope still holds the original and the stamped file. If archive soft-fails, download from the envelope. If you void an in-flight send, there is no completed export to archive. Completed envelopes cannot be voided — the filed PDF stays filed.

Share the Drive folder with the OAuth user or the service account you configured. A folder id you cannot write to is another soft-fail, not a second envelope. The audit JSON next to the stamped PDF is an export of events already stored on the envelope — created, sent, viewed, signed, completed, and the admin verbs. Reading an audit trail is how you quote those events later. Webhooks can POST the same lifecycle if you set a URL; that is not a file copy either.

Templates copy the file

Saving a template stores the PDF and its field marks on the workspace. Starting an envelope from that template copies the layout onto a new envelope. You are not re-uploading unless you change the file. Templates versus one-off envelopes is when to save. A one-off unique PDF still uses this same storage path. Bulk send and Web Forms reuse that stored template file — they do not keep a second upload per row or per fill.

Place fields after the file is stored. Coordinates are page percentages so the completed object receives the same layout. If preview says it could not load the PDF, refresh; a missing or empty stored object returns that error instead of a blank editor — re-upload if you are the sender. Place signature fields on a PDF is the mark pass. The signer never uploads a replacement file.

Who can see the file

Owners, admins, and members in the same workspace can open the envelope and download. Signers see only the tokenized page — they do not browse Documents. Another organization cannot read the object even if they guess the document id. Roles stay ordinary. Settings → File storage is the flag, not a public bucket browser.

If you need the same PDF next week, save a template instead of hunting the last completed envelope for a source file. If you need fifty people to sign that layout, bulk send from the template. If strangers should start it, publish a Web Form. Storage is the floor under all of those paths.

Caps and what is not open yet

An upload is not a send. The send that issues the signing link is. Free allows 5 packets a month. Free at 5 packets a month is the live cap desk send, bulk rows, Web Form fills, and API send share. Hitting it returns HTTP 402 ENVELOPE_LIMIT. Starter is 20 envelopes — more than Free — plus 3 published Web Forms. Seat counts are planning numbers; invite does not refuse when a workspace is full.

Billing is published, not charging. Checkout is not open. Text-message (SMS) is coming soon. Drive missing: Drive not configured. Stripe off: Payments not live. Local fallback still stores the PDF. None of those flags invent a second copy. The FAQ points at files help for the same storage sentences.

Upload a real PDF. Confirm Settings shows S3-compatible or Local fallback. Send one envelope. Download the stamped copy from that envelope after they sign. If Drive is off, you still have the file. Ask Inkpacket for how file storage works if you want the help section while you are signed in. Open a workspace on Free and read published pricing if you want the proposed lanes — storage does not wait on a card.