The short answer
Most ERPs (Sage X3, ERPNext, NetSuite and others) let users attach files to orders, invoices, journal entries, items and employees, and attachments drift into a second, unmanaged document store. To simplify: agree what goes where, name files consistently, attach each to the transaction it supports. To secure: role-based access, protected storage, scanned uploads, required retention and backups you have actually restored.
Why attachments matter
They are the evidence behind your entries (the invoice behind a payable, the receipt behind an expense claim, the contract behind a recurring bill), which auditors and the Nigeria Revenue Service (NRS) may request. Many hold personal data (employee records, customer identification, banking details) that the Nigeria Data Protection Act 2023 (NDPA) requires you to protect.
Common problems
Scattered documents
ERP, email, shared-drive and WhatsApp copies; which is authoritative?
Wrong record
An invoice attached to the supplier, not the purchase invoice it supports.
Access too broad
Payroll or HR files visible to anyone opening a related record.
Large or unreadable files
Full-resolution receipt photos, or scans too faint to read.
No retention rules
Files kept forever, or deleted too early.
Backups that skip files
Database backups that leave out the file store.
Simplifying attachments
- Attachment policyList documents attached and the ERP record each belongs to.
- Consistent namesType, counterparty, number, date; PDF documents, compressed photos.
- Capture at sourceReceipts from a phone with expenses; invoices as payables enters them.
- Stop parallel storesNo "just in case" copies on a shared drive.
Attach to the transaction, not the master record, unless the document applies to all transactions (a supplier's banking confirmation or insurance certificate). Compressed photos also help staff uploading over slow mobile connections.
Platform help and automated capture
- Frappe, the framework ERPNext runs on, can optimise uploaded images and lets administrators limit the number of attachments per document type (Frappe).
- Automated capture (email-in or OCR) can reduce re-keying, but check its accuracy before trusting it.
Securing attachments
| Control | What to do |
|---|---|
| Access control | Attachments often follow the record's permissions. In Frappe and ERPNext, anyone with read access to a document can access its attachments (Frappe), and permissions are managed through roles (ERPNext) |
| Private storage | Private files (authorised users only), never public folders or buckets; cloud buckets block public access and are encrypted |
| Upload controls | Restrict file types, limit size, scan for malware. Frappe's default per-file limit is adjustable when self-hosted (Frappe) |
| Safeguards by sensitivity | The NDPA requires appropriate technical and organisational measures, proportionate to the risk (NDPC). Tightest for identification, banking and health information. A file store hosted outside Nigeria also brings in the NDPA's transfer rules |
| Audit trail | Log who uploaded, viewed, changed or deleted files, where supported |
So role design is critical: whoever can read employee records can read their attachments. Review HR, payroll and banking roles first.
Retention, scanning and backups
General information, not tax or legal advice. Back up the file store with the database, keep one copy offline or immutable, and test that a restore brings attachments back on the right records. Where power is unreliable, put the file server and backup storage on UPS or inverter supply so an outage does not corrupt files mid-write.
Attachment health check
- Written list of which documents attach to which ERP records
- File naming and format rules documented and followed
- Sensitive documents stored privately, never at public URLs
- Roles that read HR, payroll and banking records reviewed
- File types and size limits set; uploads scanned
- Retention periods agreed with our accountant
- Scanning meets our accountant's expectations, or originals kept
- Backups include attachments, and a restore has been tested
- Duplicate stores (shared drives, inboxes, chat groups) retired
Limitations
Settings and storage options differ by ERP product, version and hosting. Large volumes, engineering drawings or complex approvals may need a document management system linked to the ERP.
Next step
We configure ERPNext and Prometheus with role design, private storage, backups and retention in mind, and customise and automate document capture. Changing ERP? See preparing your data for migration.
Sources and further reading
Product capabilities and guidance change. These are the primary sources this article relies on, checked on the review date above.
- Attachments, Frappe Framework documentation
- Role Based Permissions, ERPNext documentation (Frappe)
- Nigeria Data Protection Act 2023 and guidance on security of personal data, Nigeria Data Protection Commission
This article is general information, not legal, accounting or security advice for your specific situation. Examples are hypothetical unless stated otherwise.