Set up your private storage

Mosce ERP uses a BYOS (Bring Your Own Storage) model. Configure a private S3-compatible private bucket just once in Settings → Integrations → Storage, and that same bucket becomes the destination for all the sensitive files your account produces.

Reading time: ~8 min

What your private storage is used for

Once you connect your private bucket, Mosce ERP uses it as the single destination for every sensitive file it generates on your behalf:

• Backups (Professional plan or higher) - each automatic or on-demand backup is encrypted with AES-256 and written directly to your bucket.
• Scheduled exports (Professional plan or higher) - the export files that run in the background are stored there.
• Results of large asynchronous exports - when the volume of an export exceeds your plan's synchronous limit, the result is uploaded to your bucket and you're given a signed download link.
• Import error reports - the details of rejected rows in a bulk import are saved to your bucket so you can review them without cluttering the interface.
• Product images - when you upload images to your catalog, they are stored in your bucket.
• Your company's logo - the brand image shown on the platform and on generated documents. This is the one file that does not depend on your storage: every company can upload its logo even without it configured, and in that case the platform keeps it. With your storage connected, new logos are kept here; if you later delete its credentials or replace them with another storage, the logo kept here stops appearing on your documents until you upload it again (see Delete the saved credentials). Either way the logo is kept when your company's data is reset.
• Other sensitive files Mosce ERP generates in the future - the bucket is the consolidated destination for any new private artifact the platform introduces.

---

Why the bucket must be private

Critical warning: Mosce ERP rejects any write operation if it detects that the configured bucket has public access enabled. A public bucket exposes all your sensitive files to the internet without restriction: backups, images, exports, reports - any file the platform has written to your account.

The privacy requirement is not optional: Mosce ERP verifies that the bucket is private at the moment you save the configuration. If the bucket becomes public after configuration, write operations will fail with a privacy validation error.

---

Why keeping it private is your responsibility

Mosce ERP validates that the bucket does not allow public reads when you save it (it performs a HEAD check), but it does not control the IAM policies or the network configuration of your storage provider. That means:

• If someone with access to your provider account changes the bucket policy after configuration, Mosce ERP won't detect it until the next write attempt.
• Granular access rules (which users or services can read the bucket) are your sole responsibility.

Configure the bucket with the most restrictive permissions possible and review those policies regularly in your storage provider's panel.

---

Bucket requirements

Name and region

• Name: lowercase letters, numbers, and hyphens only. No dots, no special characters.
• Region: preferably the closest to your operation to minimize write latency.

S3-compatible providers

Mosce ERP works with the following S3-compatible providers. We strongly recommend Cloudflare R2 for its zero egress cost, global performance, and simplicity of configuration.

Bucket separation

The private storage bucket must be different from the bucket you use for public files (for example, an image CDN that serves with a public URL). The reasons:

1. Permission separation: the private bucket's credentials have access only to that bucket. If they are compromised, the attacker cannot access your public assets.
2. Retention policy separation: private and public files follow different lifecycle rules.
3. Audit clarity: having private files in a dedicated bucket makes it easier to audit what data exists and who accessed it.

---

Configuration step by step

Step 1 - Create the bucket in your provider

The steps vary by provider. The example uses Cloudflare R2:

1. Go to your Cloudflare panel at dash.cloudflare.com.
2. In the side menu, click R2 Object Storage.
3. Click Create bucket.
4. Choose a descriptive name (for example: mi-empresa-mosce-privado).
5. Select the region closest to your operation if available.
6. Do not enable public access - leave the "Public access" option Off or disabled.
7. Click Create bucket.

Verify that public access is disabled

Once the bucket is created:

1. Open the bucket in the R2 panel.
2. Go to the bucket's Settings tab.
3. In the Public access section, confirm it is Disabled or Off.
4. If you see an r2.dev domain enabled, disable it immediately.

Step 2 - Create the access credentials for Mosce ERP

Mosce ERP needs a pair of credentials (Access Key ID + Secret Access Key) to be able to write to your bucket. Create credentials with minimal permissions to limit access to only that bucket.

1. In the Cloudflare R2 panel, go to Manage R2 API Tokens.
2. Click Create API token.
3. Give it a descriptive name (e.g. mosce-privado-writer).
4. In Permissions, select Object Read & Write for the specific bucket (not "All buckets").
5. Click Create API Token.
6. Copy the Access Key ID and the Secret Access Key - they are shown only once.

Step 3 - Connect the bucket in Mosce ERP

1. In Mosce ERP, go to Settings → Integrations → Storage.
2. Enter:
   • S3 Endpoint - your provider's S3 endpoint URL (e.g. https://<account-id>.r2.cloudflarestorage.com).
   • Access Key ID - from the token you created in the previous step.
   • Secret Access Key - from the token you created in the previous step.
   • Bucket name - the exact name of the bucket (e.g. mi-empresa-mosce-privado).
   • Region - the bucket's region (e.g. auto for Cloudflare R2, or the specific region for other providers).
3. Check the privacy confirmation box that appears when saving.
4. Click Save and verify.

Step 4 - Verify the connection

After saving, Mosce ERP validates the connection by performing a test operation on the bucket. The result appears on screen:

• Successful connection: the bucket is ready. From this moment on, all your account's sensitive files will be stored there.
• Privacy error: the bucket has public access. Disable it in your provider and save again.
• Credentials error: the keys are incorrect or the token doesn't have write permissions. Check the token in your provider.
• Bucket name error: the bucket name doesn't exist or there's a case difference (the S3 API is case-sensitive for the bucket name).

---

Delete the saved credentials

If you stop using your private storage, or want Mosce ERP to no longer have access to it, you can delete the credentials you saved. The Discard button in the form only clears what you typed on screen; to remove what the company has saved, use the danger zone.

1. Go to Settings → Integrations → Storage.
2. In the danger zone, at the end of the card, click Delete saved credentials. The button only appears when the company has storage configured and your role has the integrations:write permission.
3. Read the list of what will happen. It is built from your company's data at that moment, so you only see what applies to you.
4. To confirm, type the exact company name and click Delete credentials.

What happens when you delete them

• The saved credentials are deleted; no file is deleted or moved.
• Everything kept there stops being accessible from Mosce ERP: product images, expense receipts, attachments, imports and exports, and backups. If you want to keep using it, you will have to upload it again to the storage you configure.
• The logo stops showing if it was kept there, until you upload it again. If you upload it without storage of your own configured, the platform keeps it.
• Automatic backups are turned off if you had them scheduled, because they would have nowhere to be saved.
• Backups and exports cannot be created or downloaded until you configure private storage again.

If you later save the same connection details again, Mosce ERP gets access back to everything that was there.

After deleting, a notice confirms it and says whether automatic backups were turned off.

If it cannot be deleted

• There is nothing left to delete. If someone else deleted the credentials before you, a notice says they were already deleted, the dialog closes and the screen is updated.
• The settings changed while deleting (for example, someone saved other credentials at the same time). Nothing is deleted. Check the list in the dialog, which updates itself, before trying again from there.

---

Common mistakes

Frequently asked questions

Can I use the same bucket I already have for public files (CDN)?

No. The private storage bucket must be different from the one you use for files with public access. See the Bucket separation section.

Does Mosce ERP have access to read my files at any time?

No. Mosce ERP writes to your bucket using the credentials you provide. It only has access during write operations and to generate temporary signed download URLs. You can revoke the token in your provider at any time.

What happens if I lose the credentials?

Create a new token in your provider and update the credentials in Settings → Integrations → Storage. The files already written to the bucket are not affected - only future writes are lost while the credentials are not valid.

Do I need a separate bucket for backups?

No. The same bucket you configure in Settings → Integrations → Storage is used for all the functions that generate private files, including backups.

---

Related

• Backups - scheduled
• Backups - on-demand
• Restore a backup
• Products and images
• Glossary - private bucket