> ## Documentation Index > Fetch the complete documentation index at: https://docs.ainomos.ch/llms.txt > Use this file to discover all available pages before exploring further. # File storage > Connect your own S3-compatible storage so that Ainomos keeps the original file of every imported document. When you import a document, Ainomos reads the text out of it and splits it into passages it can search. That text is all Ainomos needs to answer questions. With **File storage** set up, Ainomos also keeps the original file, so people can download a document exactly as it was issued, for example a signed PDF. Ainomos keeps originals in storage that your organisation owns and controls: any S3-compatible storage, such as AWS S3, MinIO, NetApp StorageGRID, Ceph, or a Swiss provider. Who can do this: platform admins set up, change and remove the storage. Anyone who may read a document can download its original. ## What is kept * The original file of every document imported after the storage is saved, PDF or Markdown. * Not kept: a file from which the import removed a secret, because a file cannot be partly removed. * Not kept: files imported into a room that masks personal data. The original would carry exactly what the room keeps out. Which rooms mask personal data depends on their [data class](https://docs.ainomos.ch/privacy/data-classes.md). The installation sets which data classes mask; by default it is C1. | Room's data class | Original kept (default setup) | | - | - | | C0 | Yes | | C1 | No, the room masks personal data | | C2 | Yes | | C3 | Yes | Documents imported before you set up the storage have no original, and saving the storage later does not add one. Ainomos writes and deletes only below the folder you name. When the organisation is erased, Ainomos deletes its originals in your storage too. ## Before you start Have these ready from whoever runs your storage: * The address of the storage over HTTPS. For AWS S3 you need no address. * A bucket, and a folder inside it for Ainomos. * An access key that may read, write and delete in that folder. * For storage in your own data centre: the certificate authority that issued the storage's certificate, as a PEM file, if it is not a public one. ## Connect your storage **1. Open File storage** Open **Settings**, then **File storage**. **2. Fill in the fields** See the table below. **3. Test the connection** Click **Test connection**. The test saves nothing. **4. Save** **Save** becomes available once the test passes for exactly these values. Ainomos runs the test once more when you save. The page confirms "The file storage is saved. Originals of documents imported from now on are kept here." | Field | What to enter | | - | - | | **Endpoint** | The storage address. It must start with https\://. Leave it empty for AWS S3. | | **Bucket** | The name of the bucket. | | **Region** | The region the bucket is in. | | **Folder** | The folder inside the bucket. Ainomos writes and deletes only below it. | | **Sign-in** | How Ainomos signs in. See the options below. | | **Access key ID** and **Secret access key** | The access key, when you sign in with one. The secret is stored encrypted and never shown again. When a secret is already stored, leave the field empty to keep it. | **Sign-in** offers two options: | Option | When to use it | | - | - | | **Access key** | The usual choice. Enter the key ID and its secret. | | **This installation's AWS role** | Only on an installation that runs on AWS and has its own role. Ainomos then needs no key. Where no such role exists, the option is greyed out and the page says "This installation has no AWS role. Sign in with an access key." | Open **Storage in your own data centre** for two more settings: | Setting | What it does | | - | - | | **Path-style addresses** | Tick it for MinIO and most storage on premises. | | **Certificate authority** | Click **Choose file** to upload the PEM file of your certificate authority. Once saved, the page shows its fingerprint. Use **Replace** or **Remove** to change it. | ## What the test checks The test runs six steps in order and shows the result of each: 1. **Reach the address**: the storage answered over TLS with a trusted certificate. 2. **Sign in**: the storage accepted the key or role. 3. **Find the bucket**: the bucket exists, in the region given. 4. **Write a test file**: below your folder. 5. **Read it back**: the same bytes come back. 6. **Delete the test file**: so that erasing the organisation can remove its originals. If Ainomos may write but not delete, the test still passes and warns that erasing the organisation would leave its originals in the bucket. When a step fails, it says why. The most common reasons: | Message | What to do | | - | - | | The address must start with https\://. | Use the HTTPS address of the storage. | | This installation does not allow private storage addresses. | Ask the operator of your installation to allow the host. | | The certificate is not trusted. | Upload your certificate authority under **Storage in your own data centre**. | | The storage refused the access key. | Check the key ID and secret. | | There is no bucket with this name at this address. | Check the bucket name and the endpoint. | | The bucket is in another region. | Correct the region. | | Ainomos may not write to this folder. | Give the key write permission on the folder. | ## When no storage is set up Imports work as usual. Ainomos reads the text, people can search it and ask about it. Only the original file is not kept, and the document says "No original file was kept for this document." If the storage stops answering, imports carry on without keeping originals, and existing originals cannot be downloaded until it is back. The text of every document stays available. [System status](https://docs.ainomos.ch/admin/system-status.md) shows **File storage** as down, with the reason. ## Change or remove the storage Change the fields, test again and save. The new settings apply to documents imported from then on. If you point Ainomos at a different bucket or folder, it no longer finds the originals stored in the old place, and those documents show as having no original. To stop keeping originals, click **Remove storage** and confirm. Originals already stored stay where they are in your bucket. Documents imported from then on keep no original. Saving and removing the storage are recorded as evidence. The secret never appears in a record. ## Related * [Documents](https://docs.ainomos.ch/knowledge/documents.md) * [Importing documents](https://docs.ainomos.ch/import/documents.md) * [Data classes](https://docs.ainomos.ch/privacy/data-classes.md) * [System status](https://docs.ainomos.ch/admin/system-status.md) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.