---
title: "Storage destinations"
description: "Choose where Outpost keeps files such as ticket attachments, session recordings, and Outpost Sync files, and move files between destinations."
url: "https://support.outpostplatform.com/depot/storage/"
product: "depot"
type: "how-to"
status: "draft"
ai_summary: "Settings > Storage in the Outpost console: where Outpost keeps files. Destinations are Outpost Cloud Storage, an S3-compatible bucket, a local or network path on the server, or a Windows network share for backups only. Covers the default destination, encryption, quotas, usage, and moving files between destinations. Home Lab uses its own storage only. Needs storage:manage."
availability:
  plans: ["home-lab", "essentials", "enterprise", "msp"]
  permission: "storage:manage"
  preview: false
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/depot/storage.md"
license: "CC BY 4.0"
---

# Storage destinations

A storage destination is a place Outpost keeps files. You can configure
several, choose one as the default, and move files from one to another. This
page explains the kinds of destination, then shows how to add one, make it the
default, and move files between destinations.

## What is stored

Files that Outpost stores in your default destination include:

- Ticket attachments
- Remote session recordings
- Outpost Sync files
- Installers uploaded to the software catalog
- The sign-in page logo

Endpoint backups can also go to a storage destination. See [Backup](/backup/).

## Kinds of destination

| Type | Where the files go | Notes |
| --- | --- | --- |
| Outpost Cloud Storage | Storage Outpost runs for you | Listed with the **Outpost Cloud** chip. It needs no configuration and cannot be edited or deleted. Always encrypted. Usage is metered. See [Plans and limits](/account/plans-and-limits/). |
| **S3-compatible bucket** | A bucket in your own account with **Amazon S3**, **Cloudflare R2**, **Backblaze B2**, **Wasabi**, **MinIO**, **DigitalOcean Spaces**, or **Other S3-compatible bucket** | Outpost charges nothing for it. Your provider may charge for storage and transfer. |
| **Local or network path on this server** | A directory the Depot server process can reach, such as `D:\outpost-storage` or a network share mounted on the server | Not offered when Outpost hosts your Depot, because the path would be on Outpost's server. Files are encrypted at rest. |
| **Windows network share (backups only)** | A share such as `\\server\share` that each Windows endpoint writes its own backups to | Holds backups only, and cannot be the default. Endpoints on other systems skip it. Depot never reads or tests it. |

On the MSP plan, **Settings** > **Storage** at practice level sets the
fallback destinations for every client that has no storage of its own. A
single client's destinations are set from that client's page.

Remote Outpost cannot reach Outpost Cloud Storage, so it is not offered there.
Until you add a destination, files stay on the server's own disk.

:::note
Home Lab uses your own S3-compatible storage only. Writing to Outpost Cloud
Storage on Home Lab is refused with **Add your own storage**. Essentials,
Enterprise, and MSP include Outpost Cloud Storage. See
[Plans and limits](/account/plans-and-limits/).
:::

## Before you begin

- You need `storage:manage`. Among the built-in roles, only the owner holds it.
  Anyone else sees **You need the storage permission to manage storage
  destinations.**
- For an S3-compatible bucket, create the bucket and an access key that can
  read, write, and delete objects in it.
- For a Windows network share, decide which account opens it. You can save the
  account's credential in your credential vault, or use each endpoint's own
  machine account.

## Add a destination

1. Go to **Settings** > **Storage**.
2. Select **Add storage destination**.
3. In **Name**, enter a name you will recognize, such as `Wasabi bucket`.
4. In **Type**, choose the type.
5. Fill in the fields for that type:
   - **S3-compatible bucket**: choose the **Provider**, then enter the
     **Endpoint URL**, **Region**, **Bucket**, **Access key ID**, and **Secret
     access key**. The placeholders show the format for each provider.
   - **Local or network path on this server**: enter the **Directory path**.
     A network path must be reachable by the Depot server process.
   - **Windows network share (backups only)**: enter the **Share path**, such
     as `\\server\share`, and choose the **Share credential**, or **None: use
     the endpoint's own machine account**.
6. In **Quota in GB (optional)**, enter a limit, or leave it blank for no
   limit.
7. Select **Save destination**.

For an S3-compatible bucket, **Encrypt objects before sending them to this
storage destination** is selected by default. Each file is sealed with
AES-256-GCM under its own key before it leaves the server, and the keys never
go to the bucket, so the provider only holds ciphertext. Clear it only if
another system needs to read the files straight from the bucket. Outpost Sync
files are always encrypted.

:::caution
Do not map a backup share as a drive for users, and give the backup account
the only write access to it. Ransomware that reaches a mapped share can
encrypt the backups on it too.
:::

Saved credentials are never shown again. When you edit a destination, leave
**Access key ID** and **Secret access key** blank to keep the current values.

## Test a destination and check its usage

On the destination's row:

- **Test connection** checks that Outpost can reach the destination. The
  **Last test** column shows **OK** or **Failed**, with the error under the row.
- **Usage** shows what the destination holds, by type, in objects and bytes.

## Make a destination the default

Select the radio button in the **Default** column of the destination's row.
New files go to the default destination. Files already stored stay where they
are until you move them.

**Disable** keeps a destination's settings without letting new files go to
it. **Delete** removes the destination.

## Move files between destinations

Moving files copies everything of the chosen types from one destination into
another, then removes the originals. Files stay readable throughout. Each file
is verified at the new destination before its original copy is removed.

1. On the **Move stored files** card, select **Move files between
   destinations**.
2. In **Move files out of**, choose the source.
3. In **Into**, choose the destination.
4. Under **What to move**, keep **Ticket files**, **Session recordings**, and
   **Outpost Sync files** selected to empty the source, or clear the types to
   leave where they are.
5. Select **Start migration**.

The card shows progress as files move, and you can leave the page and come
back. Only one migration runs at a time. **Cancel migration** stops it and
keeps everything moved so far. A file that cannot be moved stays at the source
and is counted on the card.

Moving files out of an S3-compatible bucket downloads every object once. Your
storage provider may charge egress or API fees for it. Those charges come from
your provider, not from Outpost.

On Home Lab, you can move files out of Outpost Cloud Storage into your own
storage, but not into Outpost Cloud Storage.

On the MSP plan, the **Move stored files** card is not on the practice-level
**Settings** > **Storage** page, because the practice's fallback destinations
belong to no single client.

## Verify

The **Storage destinations** card shows your destination with **active** in
**Status**, **OK** in **Last test**, and the **Default** radio button selected.

## Next steps

- [Backup](/backup/)
- [Outpost Sync](/sync/)
- [Plans and limits](/account/plans-and-limits/)