DAM requirements checklist

Uploading 100 files at once by drag and drop works without errors or manual retries

Bulk upload keeps your folder structure, as collections or something equivalent

Existing storage (S3-compatible buckets, WebDAV shares, Google Drive) can be imported on a schedule, not only once

Every upload is scanned for viruses before other users can see it

Duplicates and near duplicates are flagged when files come in, before they clutter the library

Previews and thumbnails are created automatically for images, video, audio and documents, including layered design files and multi-page PDFs

Embedded metadata (EXIF, IPTC, XMP) is read on upload and mapped to the right fields

When an upload fails or is interrupted, the system explains what happened and lets you retry without creating duplicates

Administrators can create their own metadata fields (text, date, single choice, multiple choice) without help from the vendor

Controlled vocabularies keep tags consistent, so two people can't spell the same term two different ways

AI enrichment runs on upload: tags and captions for images, transcripts for video and audio, text recognition (OCR) for scans and images

People can edit and correct AI metadata, on a single asset or in bulk

A plain-language search such as "team celebrating outdoors" finds relevant assets even when none of those words appear in their metadata

Starting from any image, you can find visually similar ones

Search results can be filtered by any field (type, date, orientation, custom fields) without leaving the results

Metadata on hundreds of assets can be changed in one operation, with visible progress

Usage rights, license periods and expiry dates are stored on the asset, not in a separate spreadsheet

Rights are enforced, not just displayed: users without special access can't download an expired or embargoed asset

Model and property releases can be attached to the assets they cover

Access rules can limit who can view, download or share an asset by user, group or region, and follow a standard policy format (ODRL)

Before saving a permission change, an administrator can see exactly what a given user or guest will have access to

Every access and download is logged with who, what and when, and the log can be exported

Older versions of an asset stay available, and you can see what changed between versions

Deleted or archived assets can be restored within a set period

Share links can be public, limited to specific email addresses, or password protected, each with an optional expiry date

People you share with can download the formats you choose (original, web size, watermarked) without creating an account

A brand portal lets partners help themselves to approved assets, with no login needed for public portals

Portals and share pages show your branding, not the vendor's

Watermarks can be added automatically and can include details about the recipient, such as their name and the date

Each share link shows who downloaded what, and when

Assets can be exported in bulk as zip files or contact sheets

When a shared asset is updated, the same link can deliver the new version

A documented REST API covers the whole asset lifecycle: upload, metadata, search, collections, sharing and user management

Each integration gets its own API token with limited permissions, which you can revoke at any time

Webhooks tell other systems right away when assets are created, updated or deleted

A TypeScript SDK is available and kept up to date with the API

AI assistants can search, fetch and organize assets through an MCP server

Images can be resized, cropped and converted through a URL, so your websites don't need to store their own copies

The API documentation is generated from the running system, so it stays accurate

Rate limits are published, high enough for your integrations, and it's clear what happens when you reach them

Single sign-on works with your identity provider (Google, Microsoft) on the plan you would buy

Roles and groups can follow your organization, and permissions can be given to groups instead of one person at a time

The product can be self-hosted with Docker, and the self-hosted version is the same product as the cloud service (see self-hosting)

You can choose or control where asset data is stored, to meet data residency rules

Assets sit on standard object storage you could move away from, not in a closed proprietary format

You can export all assets and their metadata at any time, in a documented format

Security practices are documented: encryption in transit and at rest, backups, and a way to report vulnerabilities

The hosted service publishes its uptime, past incidents or a status page

Someone non-technical can find a specific asset in their first session, without training

Viewers and occasional users don't need paid seats, so giving everyone access doesn't raise the bill (see the cost guide)

Administrators can invite users in bulk from a spreadsheet and put them in groups at the same time

The interface is available in the languages your team uses

Analytics show what people search for, what they can't find and what they download, so you can fill the gaps

Changes to settings are recorded, so a bad configuration can be found and undone

User documentation is up to date and can be searched from inside the product

You can try the product with your own files on a free plan or trial, before any sales conversation