Capability
A media library that knows whether a picture contains a person.
Up to a million assets per tenant, deduplicated by content, restricted by default and published to a content delivery network only after somebody has said whether it holds personal data. It is also the image source for the campaign designer, so a picture used in an email already carries a scope and a publication state.
Unclassified is the default, and it is not publishable.
Every asset carries an explicit data-protection scope: it contains personal data, it does not, or it is unclassified. Unclassified is the real default rather than a silent assumption of safety, and an unclassified asset cannot be published. That closes both ways of not having thought about it — never classified, and classified out of scope by mistake.
An asset that does contain personal data can never be published to the CDN at all. A delivery network caches at edge locations worldwide by its nature, and we are not going to describe that as EEA residency. Those assets are served restricted, from an EEA origin, behind a signed URL or a signed cookie. The enforcement is in code with tests behind it, not a warning dialogue.
- Scope is settable in bulk at collection level
- Moving an asset from in-scope to out-of-scope is audited with the actor and a reason
- Only in-scope assets are subject to retention; unclassified assets are inert until somebody classifies them
- Publishing is a separate capability from editing, so an Asset Editor can add and tag but not publish or delete
The library, in parts.
Upload and deduplication
Identical bytes are stored once within your tenancy and reference-counted. Deduplication deliberately does not cross tenants, because keeping isolation absolute is worth more than the storage.
Renditions on demand
Four presets — thumbnail, small, medium and large — generated when first requested and then cached, rather than pre-generated in every size for every asset that may never be used.
Publish and withdraw
A published asset gets a long-lived CDN URL behind an unguessable random token that is never derived from the tenant or asset identifier. Withdrawing rotates the token immediately, so it is dead at origin at once.
Facet search
By type, collection, tag, scope, date, dimensions and filename prefix — designed to stay usable at a million assets without provisioning a search cluster. Zero-result searches are logged as evidence for what to add next.
Similarity and AI suggestions
Similarity search, plus optional AI metadata suggestions on request only — a button, and an API that does the same thing — never automatically at upload.
Metadata that means something
Title, description, alt text, tags and SEO fields, plus metadata families for robots directives, geography and capture data, and its own category tree with scoped roles.
On your key, on request, and never for personal data by default.
AI suggestions run on your own model provider key. The platform deliberately does not hold one: you contract with the processor, so you accept their terms. On an unpaid key the provider's own terms forbid sending personal information, and the platform refuses to do it whatever is switched on.
Suggestions arrive as candidates for a person to accept, edit or reject. An accepted suggestion keeps its provenance, so it stays distinguishable from a human-entered value forever — which matters the first time somebody asks where a description came from.
- Never automatic at upload — a person asks for suggestions
- Unavailable by default for assets holding personal data unless you explicitly enable it
- Accepted values are marked as accepted from a suggestion
- Withdrawal state is reported as observed rather than guessed — the interface says requested or confirmed, because the vendor publishes no completion time
Questions about assets
How many assets can one tenant hold?
The module is designed for up to a million per tenant, using Firestore for facet search rather than a provisioned search cluster. Fuzzy full-text search is explicitly out of the first version; zero-result searches are recorded as evidence for whether to add it.
What happens when I unpublish something?
The access token rotates immediately, so the asset is dead at origin straight away, and cache invalidation is requested. The interface then reports the observed state of that invalidation — requested, or confirmed complete — rather than showing a countdown, because the vendor's own documentation publishes no completion time and inventing one would be a lie with a progress bar.
Can I use an external image in an email instead?
Yes, and the designer records which you used. It is not a formatting distinction: loading a remote image in an email discloses the recipient's address and open time to that host — the same disclosure a tracking pixel makes. The platform lists external sources by host, so a campaign review can see which, not merely how many.
Does the asset library respect retention?
It reuses the platform's existing retention service rather than implementing a second one. Only assets classified as in scope are subject to retention and expiry. Unclassified assets are inert — never expired, and never publishable — until somebody classifies them.
Related capabilities
Classification, deduplication and publishing are much easier to judge against your own library than against a demo set.