Skip to main content

​
Storage modes

In both modes Enclave encrypts every file before it leaves your browser using AES-256-GCM. Your storage backend receives only ciphertext — Kvelden never has access to plaintext file content.
BYOS is managed at Organization → Storage. Only users with the Owner role can add, activate, or delete backends. BYOS requires the Enterprise Advanced plan.

​
Supported backends

For step-by-step setup guides, see the sub-pages:

AWS S3

Assume Role (cross-account, no stored credentials) or static access key setup for standard AWS S3 buckets.

MinIO

Self-hosted MinIO on-premise or in your own VM. Full S3-compatible setup with presigned upload support.

​
Scope assignment

Each backend is scoped to an org unit level. Enclave resolves storage using strict precedence — the most specific scope wins: After saving a backend, go to Security → Policies → Storage to assign it to a scope. Only the active backend for a scope is used — registering multiple backends for the same scope and activating only one gives you a safe switch-over path.

​
Activating a backend

Adding a backend saves it in inactive state. To start routing uploads to it:
  1. Navigate to Organization → Storage
  2. Locate the backend in the Your Storage Backends table
  3. Open the ⋯ menu → click Activate
Enclave deactivates any previously active backend in the same scope and activates the new one atomically.

​
Platform Storage and BYOS coexistence

Platform Storage is always available as a fallback. Once you activate a BYOS backend for a scope, all new uploads in that scope go to your backend. Files uploaded before BYOS was configured remain in Platform Storage — there is no automatic migration.
Contact support@kvelden.com if you need assistance with a bulk data migration from Platform Storage to a BYOS backend.

​
Required roles