> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kvelden.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Storage

> Keep file data inside your own infrastructure with Bring Your Own Storage (BYOS). Enclave handles all encryption, access control, and key management — your backend receives only ciphertext.

## Storage modes

| Mode                              | Where files live                                        | Best for                                                             |
| --------------------------------- | ------------------------------------------------------- | -------------------------------------------------------------------- |
| **Platform Storage**              | Kvelden's geo-redundant, AES-256 encrypted object store | Getting started; no infrastructure to manage                         |
| **BYOS** (Bring Your Own Storage) | Your AWS S3, MinIO, or Azure Blob backend               | Regulated environments, data-residency requirements, or cost control |

<Info>
  In both modes Enclave encrypts every file before it leaves your browser using AES-256-GCM. Your storage backend receives only ciphertext — Kvelden never has access to plaintext file content.
</Info>

BYOS is managed at **Organization → Storage**. Only users with the **Owner** role can add, activate, or delete backends. BYOS requires the **Enterprise Advanced** plan.

***

## Supported backends

| Backend                           | Provider value  | Auth options                                  |
| --------------------------------- | --------------- | --------------------------------------------- |
| AWS S3                            | `aws`           | Assume Role (recommended), Static credentials |
| MinIO                             | `minio`         | Static credentials (access key + secret)      |
| S3-Compatible (Ceph, Wasabi, B2…) | `s3-compatible` | Static credentials                            |
| Azure Blob Storage                | `azure`         | Storage account key                           |
| NFS                               | `nfs`           | Mount-path access (server-side only)          |

For step-by-step setup guides, see the sub-pages:

<CardGroup cols={2}>
  <Card title="AWS S3" icon="aws" href="/enclave/storage/aws-s3">
    Assume Role (cross-account, no stored credentials) or static access key setup for standard AWS S3 buckets.
  </Card>

  <Card title="MinIO" icon="server" href="/enclave/storage/minio">
    Self-hosted MinIO on-premise or in your own VM. Full S3-compatible setup with presigned upload support.
  </Card>
</CardGroup>

***

## Scope assignment

Each backend is scoped to an org unit level. Enclave resolves storage using strict precedence — the most specific scope wins:

| Scope                | What it covers                                    |
| -------------------- | ------------------------------------------------- |
| **Department**       | Files for that department only (highest priority) |
| **Domain**           | Files for all departments in the domain           |
| **Tenant-wide**      | All files across the organisation                 |
| **Platform Storage** | Fallback when no BYOS backend is active in scope  |

After saving a backend, go to **Security → Policies → Storage** to assign it to a scope. Only the **active** backend for a scope is used — registering multiple backends for the same scope and activating only one gives you a safe switch-over path.

***

## Activating a backend

Adding a backend saves it in **inactive** state. To start routing uploads to it:

1. Navigate to **Organization → Storage**
2. Locate the backend in the **Your Storage Backends** table
3. Open the **⋯** menu → click **Activate**

Enclave deactivates any previously active backend in the same scope and activates the new one atomically.

***

## Platform Storage and BYOS coexistence

Platform Storage is always available as a fallback. Once you activate a BYOS backend for a scope, all new uploads in that scope go to your backend. Files uploaded before BYOS was configured remain in Platform Storage — there is no automatic migration.

<Info>
  Contact [support@kvelden.com](mailto:support@kvelden.com) if you need assistance with a bulk data migration from Platform Storage to a BYOS backend.
</Info>

***

## Required roles

| Action                          | Required role           |
| ------------------------------- | ----------------------- |
| View storage backends           | Owner                   |
| Add / delete backends           | Owner                   |
| Test a backend                  | Owner                   |
| Activate / deactivate a backend | Owner                   |
| Assign to a scope via Policies  | Owner, Security Officer |