6. Your own storage

By default, LeavenIT keeps a folder's tables. A folder owner can instead keep them in an S3-compatible bucket they own. Tools, blocks and flows keep working the same way: only the place where table files live changes.

6.1 How it works

• The bucket belongs to the folder owner, with a provider they choose and pay.
• LeavenIT keeps a restricted access key, encrypted in its vault. It is never shown again, never sent to browsers, never given to a Runner.
• For every read or write, LeavenIT checks the person's rights, then signs a short-lived address (AWS Signature V4). The browser (or the Runner) transfers the file directly between the device and the bucket.
• What you gain: no LeavenIT size limit per table (up to 5 GB per table file), tables that are yours, and the possibility of a Runner (chapter 7).
• What doesn't change: calculations still run in the browser (or on a Runner). Your own storage doesn't make queries on big tables faster.
• Only table files move. Small data saved by tools with window.leavenit.get/set stays in LeavenIT.

Who can do what:

6.2 Supported providers

LeavenIT only accepts these providers (the site's security rules only allow their addresses):

Bucket names: lowercase letters, digits, . and -, 3 to 63 characters.

6.3 What every provider needs (the checklist)

1. An empty bucket, private (no public access), dedicated to LeavenIT.
2. An access key restricted to this bucket, allowed to read, write and delete objects, nothing more. You get an Access key (public identifier) and a Secret key (shown once by the provider: store it in a password manager).
3. A CORS rule on the bucket, so the browser may use it from leavenit.com. LeavenIT shows it, ready to paste:

[
  {
    "AllowedOrigins": ["https://leavenit.com"],
    "AllowedMethods": ["GET", "PUT", "HEAD", "DELETE"],
    "AllowedHeaders": ["*"],
    "ExposeHeaders": ["ETag"],
    "MaxAgeSeconds": 3600
  }
]

If the provider's console has no CORS screen, use the AWS command line tool, which works with every provider (LeavenIT shows this command with your bucket and address filled in):

aws s3api put-bucket-cors --bucket <bucket> --cors-configuration file://cors.json --endpoint-url https://<address>

4. No click tracking, no public website, no custom domain on the bucket: LeavenIT uses the provider's own address.

6.4 Connecting a folder, step by step

1. Workshop → open the shared folder (or My Workshop) → the ⋯ next to its name → Storage. For a folder with separate data (lock icon): its ⋯ → Storage.
2. Use my own storage: choose the Provider, the Region (and the Account ID for Cloudflare R2), then fill Bucket, Access key, Secret key.
3. Save and test. LeavenIT writes, reads back and deletes a small test file through signed addresses. The result shows ✓ Write ✓ Read ✓ Delete.
4. If a step fails, the panel explains why and shows the CORS text (see 6.6). Fix, then Test again.
5. Move my N tables. A progress bar shows each table (reading, checking, writing, switching). Keep the page open. Tools keep working during the move. If the page closes, the tables already moved stay moved: Move the remaining N finishes the rest.
6. Done: the panel shows in use. New tables go to the bucket. Copies left in LeavenIT's storage are deleted after 30 days.

Going back: Move back to LeavenIT copies the current version of every table back. Tables larger than LeavenIT's limit are refused, with their names. LeavenIT never empties your bucket: your copies stay there. Replacing the key (rotation, lost or revoked key): Storage → Replace the key. Provider, region and bucket stay locked; enter the new Access key and Secret key, then Save and test. The storage stays in use. Disconnect is possible once no table is left in the bucket (and old files have been cleaned, usually within an hour).

6.5 Provider guides

Consoles change often. If a screen differs, look for the same idea under another name, or ask your AI with a screenshot.

Cloudflare R2 (tested end to end)

1. Cloudflare dashboard → R2 Object Storage → Create bucket.
   • Name: e.g. leavenit-data.
   • Location: Automatic, or a location hint in Europe. Do not choose the "EU" jurisdiction: it uses another address (<account>.eu.r2.cloudflarestorage.com) that LeavenIT doesn't accept yet.
   • Keep the bucket private (no r2.dev address, no custom domain).
2. Your Account ID: on the R2 overview page (32 characters).
3. Manage R2 API Tokens (or API Tokens) → Create API token:
   • Permission: Object Read & Write.
   • Specify bucket: only leavenit-data.
   • Copy the Access Key ID and the Secret Access Key (shown once).
4. The bucket → Settings → CORS Policy → Add CORS policy → paste the JSON of 6.3.
5. In LeavenIT: Provider Cloudflare R2, Region auto, your Account ID, bucket, keys.

Backblaze B2

1. Buckets → Create a Bucket: private, in the region you'll pick in LeavenIT (e.g. eu-central-003).
2. Application Keys → Add a New Application Key: allow access to this bucket only, type Read and Write. Copy the keyID (Access key) and applicationKey (Secret key).
3. CORS: Backblaze's S3 interface accepts the AWS command of 6.3, with --endpoint-url https://s3.<region>.backblazeb2.com. (B2's own "CORS rules" screen applies to its native interface; use the command to be sure.)

Scaleway

1. Object Storage → Create bucket: region fr-par, nl-ams or pl-waw, private.
2. IAM → create an application with a policy limited to Object Storage in this project (read, write, delete objects), then generate an API key for it: Access key + Secret key.
3. CORS: with the AWS command of 6.3 and --endpoint-url https://s3.<region>.scw.cloud.

OVHcloud

1. Public Cloud → Object Storage → create an S3 container in a region (e.g. gra), private.
2. Create an S3 user with read/write rights on this container, then its S3 credentials: Access key + Secret key.
3. CORS: with the AWS command of 6.3 and --endpoint-url https://s3.<region>.io.cloud.ovh.net.

Hetzner Object Storage

1. Object Storage → Create Bucket: location fsn1, nbg1 or hel1, private.
2. Security → S3 credentials → generate: Access key + Secret key. Hetzner's credentials apply to the project: keep a project dedicated to LeavenIT if you want them limited.
3. CORS: with the AWS command of 6.3 and --endpoint-url https://<region>.your-objectstorage.com.

6.6 Troubleshooting