> For the complete documentation index, see [llms.txt](https://docs.imerit.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.imerit.net/data/storages.md).
# Storages
Hub supports cloud storage integrations for externally hosted assets.
Ango Hub supports connecting your cloud data storage through provider-specific storage integrations.
With storage integrations, you can securely host your unlabeled assets in your cloud storage provider while viewing and labeling them on Hub. Hub uses the credentials you configure to generate temporary signed URLs only when it needs to read, list, or write files.
## Supported Cloud Providers
| Provider | Setup Instructions | |
|---|
| Amazon S3 | Here | |
| Google Cloud Platform | Here | |
| Microsoft Azure | Here | |
## Supported Data Types
| Data Type | Supported |
|---|
| Images | true |
| Video | true |
| Text | true |
| Audio | true |
| DICOM | true |
| PDF | true |
## How does credential-based access work?
For AWS S3 IAM User access and S3-compatible custom storage, you create access keys and configure policies that determine what Hub can access. For Google Cloud Platform, you provide a service account key JSON. For Azure Blob Storage, you can use either a storage account key or a Microsoft Entra service principal. Service principals use Azure RBAC and allow Ango Hub to generate temporary user-delegation SAS URLs without receiving the storage account key.
Configure provider-side permissions as narrowly as your workflow allows. For example, you can grant access to all buckets, only one bucket, or only a specific path. For Azure Blob Storage, use a service principal with container-scoped data roles when you need to isolate access without creating a dedicated storage account. [Learn how to set up Azure authentication](/data/storages/set-up-a-storage-integration-with-azure.md).
You can set up multiple storage integrations for different projects with different permissions.
## IAM Delegated Access
In addition to AWS IAM User access, Ango Hub allows you to connect AWS S3 storage with IAM delegation. [Read more about it here](/data/storages/importing-private-cloud-assets-aws.md#iam-delegation).
## How does Ango Hub access your data?
### Asset
Ango Hub will only access your data when it is necessary to display it within Hub, for example, during labeling.
To display an asset, Hub requests a temporary signed URL from the Ango backend. The backend uses the storage integration you configured to generate a signed URL for the asset. The backend then passes that URL to the frontend, which displays the asset using that temporary, expiring, signed URL.
### Metadata
Hub will occasionally also need asset metadata, such as image dimensions, video length, etc. To do so, Hub will generate a temporary, expiring, signed URL the same way, download the asset, extract the metadata it needs (also known as processing), then instantly delete it.
All asset processing is done in Germany-based data centers.
## Frequently Asked Questions
### Does setting up a storage integration change the way labels are stored?
No, annotations are stored in Ango's own storage even when the asset comes from a storage integration. The only exception to this is if Hub was installed on-premises.
### Does Ango Hub cache assets?
No. Ango Hub does not cache assets coming from storage integrations.
### Can I quickly invalidate all live signed URLs?
Yes. Remove the read permission from the connected storage credentials or provider policy, and live signed URLs will stop working once the provider rejects them.
### What permissions are required to import in a 3D MSF project?
For AWS S3, you need to give `GetObject` and `PutObject` permissions to the bucket for a successful import in 3D MSFT projects. For Azure Blob Storage, the connected account key or service principal must be able to read and write blobs in the target container.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.imerit.net/data/storages.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.