The Workspace Media Hub

Where your uploaded files live in m18t: a per-workspace storage bucket isolated by brand and namespace, plus the honest truth about storage credentials today.

What you'll learn

  • Where your uploaded files actually live, and why each workspace gets its own physical bucket.
  • How m18t separates assets by namespace (assets vs graphics) and by brand inside that bucket.
  • What's true today about storage credentials, and what's still on the roadmap.

Why media is isolated per workspace

Most multi-customer platforms dump every customer's files into one shared bucket and keep them apart with database filters. That works until a query is written wrong. m18t takes a stronger line: every workspace gets its own physical storage bucket. A workspace is one m18t account — the thing that owns one isolated database and one bucket. (If the difference between a workspace and a brand is still fuzzy, read Brand vs. Workspace first.)

So when you upload a logo, a product shot, or a generated image, the file lands in your bucket, keyed under your brand. There is no shared folder where another customer's files sit next to yours. Isolation is at the bucket boundary, not just a WHERE clause.

Inside that one bucket, m18t organizes objects by two axes:

  1. Brand. Every object is stored under its brand's prefix. Switch brands in the sidebar and the Assets Manager re-shards to show only that brand's files — same workspace, different world.
  2. Namespace. A namespace is the provenance of a file: where it came from. The two you'll see most are assets (things you uploaded by hand) and graphics (images produced by the Graphics Generator). Other namespaces exist for files attached to artifacts, content, whiteboards, brand identity slots, and email templates. The namespace becomes part of the storage key, so an uploaded image and an AI-generated one never collide even if they share a filename.

The result: one bucket per workspace, brand prefixes inside it, namespace prefixes inside those. A file's full address is roughly {workspace-bucket}/{brand}/{namespace}/{filename}. Predictable, and walled off from every other workspace.

The honest part: storage credentials are env-only today

Here's where beta candor matters. m18t's Secret Vault encrypts your AI keys, social tokens, and CMS credentials per brand. Storage credentials are the exception. Right now the storage layer reads its connection from platform environment variables, not from your vault — the vault lookups for storage are deliberately short-circuited. All workspaces share the platform's object storage, and the thing keeping your files separate from everyone else's is the bucket boundary, not a per-workspace set of storage credentials.

That's a real distinction, and we'd rather you know it than assume more separation than exists. Per-workspace bring-your-own-storage — where you point m18t at your own MinIO or S3 with your own keys — is a planned beta feature, not something you can configure today. If you're self-hosting and need to override the bucket, that path exists at the infrastructure level, but there is no in-app screen for storage credentials yet. The Where Your Files Live article covers what's configurable.

What you can rely on today: your files are in a bucket no other workspace can address, organized by brand and namespace, and indexed in your own database so the Assets Manager can search, tag, and link them.

How to find your media

  1. Open Assets Manager from the Studio sidebar (/studio/assets-manager).
  2. The current brand (set by the sidebar switcher) scopes the list. Pick All Brands in the switcher to see every brand's files at once.
  3. Use the Src column (table view) to read each file's namespace — an uploaded image shows the image icon labelled "Uploaded"; a generated one shows the wand icon labelled "Graphics".
  4. Toggle between grid and table layout with the view switch in the top bar. Grid is faster for visual scanning; table exposes namespace, status, linkage, and dimensions.

Variations

  • Self-hosted instances. The bucket is still derived per workspace. Overriding the storage endpoint happens through deployment configuration, not a settings page — see Where Your Files Live.
  • Where generated images go. Anything the Graphics Generator produces lands in the graphics namespace of your bucket. It arrives at deprecate status and you promote it deliberately — covered in that article.
  • Brand identity files. Logos and palette images set on a brand are referenced from the same bucket and show up in the Assets Manager with a "Brand identity" usage chip.

FAQ

Where are my uploaded files physically stored? In your workspace's own bucket on m18t's platform storage. Each workspace has its own bucket; files are keyed by brand and namespace inside it.

Can another m18t customer see my files? No. Your files live in a bucket addressed only by your workspace slug, and the serve route is brand-scoped and authenticated. Other workspaces cannot address your bucket.

Can I bring my own S3 or MinIO storage? Not through the app yet. Storage credentials are read from platform environment variables today; per-workspace bring-your-own-storage is a planned beta feature. Self-hosters can override at the infrastructure level.

What's the difference between the assets and graphics namespaces? assets is files you uploaded yourself. graphics is images produced by the Graphics Generator. The namespace is part of the storage key, so the two never overwrite each other.

My logo shows up in the Assets Manager — why? Brand identity images are stored in the same bucket and indexed alongside your media. They carry a "Brand identity" usage chip so you can tell them apart from loose uploads.

What's next

Was this article helpful?