Set up your private storage

Mosce ERP uses a BYOS (Bring Your Own Storage) model. Configure a private S3-compatible private bucket just once in Settings → Integrations → Storage, and that same bucket becomes the destination for all the sensitive files your account produces.

Reading time: ~8 min

What your private storage is used for

Once you connect your private bucket, Mosce ERP uses it as the single destination for every sensitive file it generates on your behalf:

• Backups (Professional plan or higher) - each automatic or on-demand backup is encrypted with AES-256 and written directly to your bucket.
• Scheduled exports (Professional plan or higher) - the export files that run in the background are stored there.
• Results of large asynchronous exports - when the volume of an export exceeds your plan's synchronous limit, the result is uploaded to your bucket and you're given a signed download link.
• Import error reports - the details of rejected rows in a bulk import are saved to your bucket so you can review them without cluttering the interface.
• Product images - when you upload images to your catalog, they are stored in your bucket.
• Your tenant's logo - the brand image shown on the platform and on generated documents.
• Other sensitive files Mosce ERP generates in the future - the bucket is the consolidated destination for any new private artifact the platform introduces.

---

Why the bucket must be private

Critical warning: Mosce ERP rejects any write operation if it detects that the configured bucket has public access enabled. A public bucket exposes all your sensitive files to the internet without restriction: backups, images, exports, reports - any file the platform has written to your account.

The privacy requirement is not optional: Mosce ERP verifies that the bucket is private at the moment you save the configuration. If the bucket becomes public after configuration, write operations will fail with a privacy validation error.

---

Why keeping it private is your responsibility

Mosce ERP validates that the bucket does not allow public reads when you save it (it performs a HEAD check), but it does not control the IAM policies or the network configuration of your storage provider. That means:

• If someone with access to your provider account changes the bucket policy after configuration, Mosce ERP won't detect it until the next write attempt.
• Granular access rules (which users or services can read the bucket) are your sole responsibility.

Configure the bucket with the most restrictive permissions possible and review those policies regularly in your storage provider's panel.

---

Bucket requirements

Name and region

• Name: lowercase letters, numbers, and hyphens only. No dots, no special characters.
• Region: preferably the closest to your operation to minimize write latency.

S3-compatible providers

Mosce ERP works with the following S3-compatible providers. We strongly recommend Cloudflare R2 for its zero egress cost, global performance, and simplicity of configuration.

Bucket separation

The private storage bucket must be different from the bucket you use for public files (for example, an image CDN that serves with a public URL). The reasons:

1. Permission separation: the private bucket's credentials have access only to that bucket. If they are compromised, the attacker cannot access your public assets.
2. Retention policy separation: private and public files follow different lifecycle rules.
3. Audit clarity: having private files in a dedicated bucket makes it easier to audit what data exists and who accessed it.

---

Configuration step by step

Step 1 - Create the bucket in your provider

The steps vary by provider. The example uses Cloudflare R2:

1. Go to your Cloudflare panel at dash.cloudflare.com.
2. In the side menu, click R2 Object Storage.
3. Click Create bucket.
4. Choose a descriptive name (for example: mi-empresa-mosce-privado).
5. Select the region closest to your operation if available.
6. Do not enable public access - leave the "Public access" option Off or disabled.
7. Click Create bucket.

Verify that public access is disabled

Once the bucket is created:

1. Open the bucket in the R2 panel.
2. Go to the bucket's Settings tab.
3. In the Public access section, confirm it is Disabled or Off.
4. If you see an r2.dev domain enabled, disable it immediately.

Step 2 - Create the access credentials for Mosce ERP

Mosce ERP needs a pair of credentials (Access Key ID + Secret Access Key) to be able to write to your bucket. Create credentials with minimal permissions to limit access to only that bucket.

1. In the Cloudflare R2 panel, go to Manage R2 API Tokens.
2. Click Create API token.
3. Give it a descriptive name (e.g. mosce-privado-writer).
4. In Permissions, select Object Read & Write for the specific bucket (not "All buckets").
5. Click Create API Token.
6. Copy the Access Key ID and the Secret Access Key - they are shown only once.

Step 3 - Connect the bucket in Mosce ERP

1. In Mosce ERP, go to Settings → Integrations → Storage.
2. Enter:
   • S3 Endpoint - your provider's S3 endpoint URL (e.g. https://<account-id>.r2.cloudflarestorage.com).
   • Access Key ID - from the token you created in the previous step.
   • Secret Access Key - from the token you created in the previous step.
   • Bucket name - the exact name of the bucket (e.g. mi-empresa-mosce-privado).
   • Region - the bucket's region (e.g. auto for Cloudflare R2, or the specific region for other providers).
3. Check the privacy confirmation box that appears when saving.
4. Click Save and verify.

Step 4 - Verify the connection

After saving, Mosce ERP validates the connection by performing a test operation on the bucket. The result appears on screen:

• Successful connection: the bucket is ready. From this moment on, all your account's sensitive files will be stored there.
• Privacy error: the bucket has public access. Disable it in your provider and save again.
• Credentials error: the keys are incorrect or the token doesn't have write permissions. Check the token in your provider.
• Bucket name error: the bucket name doesn't exist or there's a case difference (the S3 API is case-sensitive for the bucket name).

---

Common mistakes

Frequently asked questions

Can I use the same bucket I already have for public files (CDN)?

No. The private storage bucket must be different from the one you use for files with public access. See the Bucket separation section.

Does Mosce ERP have access to read my files at any time?

No. Mosce ERP writes to your bucket using the credentials you provide. It only has access during write operations and to generate temporary signed download URLs. You can revoke the token in your provider at any time.

What happens if I lose the credentials?

Create a new token in your provider and update the credentials in Settings → Integrations → Storage. The files already written to the bucket are not affected - only future writes are lost while the credentials are not valid.

Do I need a separate bucket for backups?

No. The same bucket you configure in Settings → Integrations → Storage is used for all the functions that generate private files, including backups.

---

Related

• Backups - scheduled
• Backups - on-demand
• Restore a backup
• Products and images
• Glossary - private bucket