Users can upload files to a project. On the server the directory structure looks like this:

+---files
|   +---projects
|   |   +---client-01
|   |   |   +---project-01-01
|   |   |   |   +---client-uploads
|   |   |   |   +---user-01
|   |   |   |   +---user-02
|   |   |   +---project-01-02
|   |   |   |   +---client-uploads
|   |   |   |   +---user-01
|   |   |   |   +---user-02
|   |   +---client-02
|   |   |   +---project-02-01
|   |   |   |   +---client-uploads
|   |   |   |   +---user-01
|   |   |   |   +---user-02
|   |   +---client-03
|   |   |   +---project-03-01
|   |   |   |   +---client-uploads
|   |   |   |   +---user-01
|   |   |   |   +---user-02

Admins and Managers have access to the root directory of a project. Employees and Contractors have access to a subdirectory named after their name (project-01-01/user-01), and all client company contacts have access to a subdirectory called project-01-01/client-uploads.

These directory are named after the actual client, project and user names, suffixed with a hash to make it impossible to guess names if you are not part of the project.

Do not upload documents with sensitive or secret data. While file uploads are protected with a robots.txt to prevent indexing of search engines, the files can be accessed if someone knows or guesses the full url.

Project file uploads