Source: https://fyno.docs.pageloop.ai/documentation/settings/workspace-settings/security/secure-media-storage

# Secure Media Storage

The **Secure Media Storage** feature allows you to store media files generated or processed by Fyno in your own AWS S3 bucket.

This helps organizations maintain ownership of their files and comply with internal security and data retention requirements.

Supported media includes:

- PDFs generated using Fyno's PDF component
- Incoming media files received through supported channels, such as:
  - PDF documents
  - Images (JPEG, PNG, etc.)
  - Other supported file attachments

> > [!NOTE]
> >
> >  Incoming media storage is currently supported only for messages received through Meta Direct and Meta Direct Plus integrations. 

### Before You Begin

Before enabling Secure Media Storage, create an AWS S3 bucket and an IAM user with:

- Access Key ID
- Secret Access Key
- Permission to upload files to the target bucket

> [!NOTE]
>
> The S3 bucket must be created in the `ap-south-1` region.

### Enable Secure Media Storage

![](/images/secure-media-storage.png)

1. Navigate to **Workspace Settings** → **Security**.
2. Locate **Secure Media Storage** and toggle it on.
3. Enter your AWS Access Key ID and Secret Access Key.
4. Click **Update**.

### Configure Storage for Fyno Generated PDFs

You can optionally configure a dedicated location for storing PDFs generated by Fyno.

Enable the **Fyno Generated PDFs** option. ![](/images/fyno-generated-pdfs.png)
Provide the required storage details.
Click **Update**.

#### Configuration Fields

| Field           | Description                                                                                |
| --------------- | ------------------------------------------------------------------------------------------ |
| **Base URL**    | Public URL used to access the stored PDF files. This can be an S3 URL or a CloudFront URL. |
| **Bucket Name** | Name of the AWS S3 bucket where files will be stored.                                      |
| **Folder Path** | Folder path within the bucket where PDF files will be uploaded.                            |

#### Example Using S3 URL

```text
Base URL:
https://example-bucket.s3.ap-south-1.amazonaws.com/pdf/lrn

Bucket Name:
example-bucket

Folder Path:
pdf/lrn
```

#### Example Using CloudFront URL

```text
Base URL:
https://abcdefgh.cloudfront.net/lrn
```

If your CloudFront distribution uses `/pdf` as the origin path, only the remaining folder path should be included in the Base URL.

### Configure Storage for Incoming Media

Once Secure Media Storage is enabled, incoming media files received through supported integrations are automatically stored in your configured S3 bucket.
![](/images/incoming-media.png)

#### Configuration Fields

| Field           | Description                                        |
| --------------- | -------------------------------------------------- |
| **Base URL**    | URL used to access uploaded media files.           |
| **Bucket Name** | Target S3 bucket name.                             |
| **Folder Path** | Folder path where incoming media files are stored. |

#### Example Using S3 URL

```text
Base URL:
https://example-bucket.s3.ap-south-1.amazonaws.com/incoming/media

Bucket Name:
example-bucket

Folder Path:
incoming/media
```

#### Example Using CloudFront URL

```text
Base URL:
https://abcdefgh.cloudfront.net/media
```

If the CloudFront origin path is configured as `/incoming`, only the remaining folder path should be included in the Base URL.