> For the complete documentation index, see [llms.txt](https://docs.imerit.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.imerit.net/data/storages.md).

# Storages

Ango Hub supports connecting your cloud data storage through provider-specific storage integrations.

![Click on the "Organization" link at the top, then enter the "Storages" tab.](/files/jNsLCvoc4hGypQDqkeca)

With storage integrations, you can securely host your unlabeled assets in your cloud storage provider while viewing and labeling them on Hub. Hub uses the credentials you configure to generate temporary signed URLs only when it needs to read, list, or write files.

## Supported Cloud Providers

<table><thead><tr><th>Provider</th><th>Setup Instructions</th><th data-hidden></th></tr></thead><tbody><tr><td>Amazon S3</td><td><a href="/pages/Z1Ej1DCknBtIDAkVqyAT">Here</a></td><td></td></tr><tr><td>Google Cloud Platform</td><td><a href="/pages/5fAbIOnL2Ums7qRPg2Hc">Here</a></td><td></td></tr><tr><td>Microsoft Azure</td><td><a href="/pages/hbtg5bVSyV8DrmV78xE2">Here</a></td><td></td></tr></tbody></table>

## Supported Data Types

<table><thead><tr><th>Data Type</th><th data-type="checkbox">Supported</th></tr></thead><tbody><tr><td>Images</td><td>true</td></tr><tr><td>Video</td><td>true</td></tr><tr><td>Text</td><td>true</td></tr><tr><td>Audio</td><td>true</td></tr><tr><td>DICOM</td><td>true</td></tr><tr><td>PDF</td><td>true</td></tr></tbody></table>

## How does credential-based access work?

For AWS S3 IAM User access and S3-compatible custom storage, you create access keys and configure policies that determine what Hub can access. For Google Cloud Platform, you provide a service account key JSON. For Azure Blob Storage, you can use either a storage account key or a Microsoft Entra service principal. Service principals use Azure RBAC and allow Ango Hub to generate temporary user-delegation SAS URLs without receiving the storage account key.

Configure provider-side permissions as narrowly as your workflow allows. For example, you can grant access to all buckets, only one bucket, or only a specific path. For Azure Blob Storage, use a service principal with container-scoped data roles when you need to isolate access without creating a dedicated storage account. [Learn how to set up Azure authentication](/data/storages/set-up-a-storage-integration-with-azure.md).

![](/files/RVteAGjFQFRO3nlWq6kJ)

You can set up multiple storage integrations for different projects with different permissions.

## IAM Delegated Access

In addition to AWS IAM User access, Ango Hub allows you to connect AWS S3 storage with IAM delegation. [Read more about it here](/data/storages/importing-private-cloud-assets-aws.md#iam-delegation).

## How does Ango Hub access your data?

### Asset

Ango Hub will only access your data when it is necessary to display it within Hub, for example, during labeling.

To display an asset, Hub requests a temporary signed URL from the Ango backend. The backend uses the storage integration you configured to generate a signed URL for the asset. The backend then passes that URL to the frontend, which displays the asset using that temporary, expiring, signed URL.

### Metadata

Hub will occasionally also need asset metadata, such as image dimensions, video length, etc. To do so, Hub will generate a temporary, expiring, signed URL the same way, download the asset, extract the metadata it needs (also known as processing), then instantly delete it.

All asset processing is done in Germany-based data centers.

## Frequently Asked Questions

### Does setting up a storage integration change the way labels are stored?

No, annotations are stored in Ango's own storage even when the asset comes from a storage integration. The only exception to this is if Hub was installed on-premises.

### Does Ango Hub cache assets?

No. Ango Hub does not cache assets coming from storage integrations.

### Can I quickly invalidate all live signed URLs?

Yes. Remove the read permission from the connected storage credentials or provider policy, and live signed URLs will stop working once the provider rejects them.

### What permissions are required to import in a 3D MSF project?

For AWS S3, you need to give `GetObject` and `PutObject` permissions to the bucket for a successful import in 3D MSFT projects. For Azure Blob Storage, the connected account key or service principal must be able to read and write blobs in the target container.