v1.0.11: The Documents Redesign — Your HR Filing Cabinet, Reimagined

The Problem With "Upload"

Here is the old workflow. You open /documents, hit Upload, drag in Maria's signed offer letter, pick her name from a dropdown, and click save. A week later you need to find that letter — along with her contract from last year and the visa renewal you uploaded in March.

You know it is in there. You uploaded it. But "in there" means scrolling a flat list, filtering by name, hoping you remember whether you tagged it offer or offer-letter, and squinting at thumbnails.

That friction is the entire reason we rebuilt Documents. v1.0.11 replaces the generic upload pile with a real filing cabinet — the same mental model HR teams have used on physical drawers for fifty years, ported into the product without losing any of the digital advantages.

This post is a walkthrough. Open /documents in another tab and follow along.

The Filing Cabinet Lands First

When you open /documents, you no longer arrive at an upload screen. You arrive at My Documents — a 2-3 column responsive grid of folder tiles. The cabinet is the page. There is no routing through a generic entry, no pile to sort through later. Every folder you might drop a document into is already in front of you.

Each tile shows a folder icon, a name, a document count, and a color band. Click one and you're inside that folder, looking at its contents. Click outside it and you're back at the cabinet. That's the entire navigation model.

The point of putting the cabinet first is simple: the moment you arrive with a document in hand, you're already looking at the place it belongs. You don't pick a destination from a dropdown — you pick a drawer.

Thirteen Built-In Categories

Every cabinet ships with thirteen built-in folders, pre-created and always visible — even when empty. They are:

1. Contracts
2. Offer Letters
3. Salary Increments
4. Performance Reviews
5. Policy Documents
6. ID Documents
7. Certificates
8. Training Materials
9. Medical Certificates
10. Visa Documents
11. Tax Documents
12. Insurance
13. Other

These are not suggestions. They render on day one of every account, and they keep rendering even when they hold zero documents. That choice is deliberate.

The alternative — folders that appear only after they have something in them — is the pattern most file managers use, and it sabotages the whole metaphor. If the Visa Documents folder doesn't exist until you put a visa document in it, you're back to choosing a category from a hidden list every time you upload. By keeping all thirteen visible at all times, the answer to "where does this go?" is always one click away. You drop the document straight into the right drawer.

Most teams will use ten of the thirteen heavily and the others occasionally. That's fine — the empty ones cost nothing to leave in place.

Custom Folders, On Your Terms

Built-ins cover the common cases. Custom folders cover everything else.

Each user can create their own folders, scoped to their account. They sit above the built-ins in the cabinet so your bespoke organization shows first. The rules:

• Names are capped at 50 characters. Long enough for "Q4 2026 Contractor Statements of Work" if you really want it, short enough that the tile stays readable.
• Pick an icon from a curated Lucide set. A folder for legal might take a gavel; a folder for travel docs might take a plane. The icon set is curated, not the full Lucide library — we pruned to the icons that actually read at folder-tile size.
• Pick a hex color. Each folder carries a color band so the cabinet stays visually distinct at a glance.
• Soft-delete frees the name immediately. Delete a folder called "Old Vendors" and the name slot is released the same instant — you can create a new "Old Vendors" right after if you want. The deleted folder still exists for recovery, but it no longer holds the namespace.

That last rule matters more than it sounds. The annoying version of soft-delete is when the deleted record keeps reserving the name and you have to call it "Old Vendors 2" on the second pass. We don't do that.

Tag Filtering Behaves Two Ways

Tags exist alongside folders. A document can live in Contracts and also be tagged q4-2026 or priority-review. The redesign wires tag filtering into both layers of the cabinet:

• At the cabinet level, selecting a tag drops you into a flat cross-folder result list — every document with that tag, regardless of which folder it's in. Useful when the tag is the actual axis you care about ("show me everything tagged expiring-soon, I don't care which folder it lives in").
• Inside an open folder, the tag scopes within that folder. Select q4-2026 while you're inside Contracts, and you see only Q4 contracts. The folder boundary is respected.

Same UI, two contextual behaviors. The first lets tags act as cross-cutting saved searches; the second lets them refine within a known location. Either is one click.

Two Upload Modes: Store vs Sign

Every upload now asks the same question up front: are you stashing this document, or are you routing it for signatures?

• Store — drop the file into a folder and you're done. Use this for records that are already signed elsewhere, reference documents, certificates, IDs, anything where the goal is "keep a copy I can find later."
• Sign — route the document through the signature flow. Drag-drop signature, date, and text fields onto the page. Set sequential signing if the document needs Manager → Director → Executive in that order. Each signature event lands in the audit trail with timestamp and signer identity. Use this for offer letters, NDAs, policy acknowledgments, anything that doesn't count as filed until it's signed.

The split matters because the two paths have different completion criteria. A stored doc is done the moment it's uploaded. A signed doc is in flight until every signer has finished. Treating them as the same flow forced compromises in both directions; separating them at the upload modal lets each path do its job.

The Document Detail Page, Quieter

Open any document and you land on the redesigned detail page. The change is in the proportions.

The preview pane is large — most of the screen — and the metadata sidebar is quieter: name, folder, tags, uploaded by, uploaded at, expiry if applicable, signature status if applicable. Less chrome around the edges, more document in the middle. When you click into a contract, you should be reading the contract, not navigating around it.

Actions (rename, move, delete, request signature, export) collapse into a single action menu rather than a row of always-on buttons. The fewer pixels the UI takes, the more pixels the document gets.

Expiry Reminders: 60, 30, 7, Today

Documents with expiry dates — visas, certificates, insurance, anything that lapses — drive reminders on a fixed cadence: 60 days, 30 days, 7 days, and the day of expiry. The new ExpiryRail experience surfaces this in the UI, but the reminder fan-out is what matters operationally.

Each reminder loops in:

• The document owner (whoever uploaded or is assigned to it)
• The department head of the affected employee's department
• All executives
• All administrators

Four notifications per cadence, four cadences per document. The intent is that a passport renewal three weeks out should never be a surprise to anyone who could act on it. Loop everyone with standing to follow up; let the first person to handle it close the loop.

Action Required: One Tray, Scoped By Role

Documents that need a human's attention used to scatter across the app — a sign request here, an expiring cert there, an overdue acknowledgment in a third place. The redesign consolidates them into a single Action Required tray.

The tray is unified across three categories — Sign, Expiring, and Overdue — and scoped per role:

• An employee sees their own pending signatures, their own expiring documents, and their own overdue acknowledgments.
• A department head sees those, plus the same for their department.
• Executives and administrators see the org-wide view.

One tray, one mental check at the start of the day: is anything red? If yes, click in. If no, get on with the rest of your work.

Quietly Hardened

Everything above is the user-facing redesign. Underneath, v1.0.11 is also a security release — none of which you should have to think about, but all of which is worth knowing exists.

• AES-256-GCM at rest is preserved on every new write path. Every new upload code path — store mode, sign mode, /assign, /bulk-send — encrypts at rest with the same envelope as the existing pipeline. There are no plaintext shortcuts in the new flows.
• Multi-tenancy enforced on every new endpoint. Every new route validates organization scope before it touches data. No cross-tenant leakage is possible from the new endpoints.
• Role-based access matrix unified across list, fetch, upload, bulk-send, and templates. Previously each verb had its own slightly different permission check; now there is one matrix and every verb consults it.
• Quota gates added to /assign and /bulk-send. Plan limits are now checked before fan-out, not after, so a bulk-send that would exceed your plan is rejected up front rather than partially completing.
• Calendar privacy enforced at every layer — route guard, leaves API, leave-balance API, dashboard, and per-user calendar. The privacy setting is consulted in five places, not one, so a setting change can never be bypassed by hitting a different endpoint.
• npm audit reports zero vulnerabilities. The transitive postcss and @tootallnate/once advisories are resolved (both bumped); the dependency tree is clean.

None of this changes a workflow. All of it raises the floor.

Open Your Cabinet

The redesign is live for every cloud customer. There is no migration step on your side — your existing documents are already filed into the right built-in folders, your tags carry over, and any sign requests in flight continue to work.

Head to /documents and look at your cabinet. Drop a new file into the folder it belongs in. See if you can find Maria's offer letter in under five seconds.

If something feels off or you want a category we didn't include, send us a note. We read every ticket, and the next iteration of Documents starts with what you tell us this one missed.