> ## Documentation Index
> Fetch the complete documentation index at: https://docs.convonexai.tech/llms.txt
> Use this file to discover all available pages before exploring further.

# Storage

> File and object storage for your app — uploads, images, documents — with secure, expiring links.

Apps that handle files — avatars, receipts, CSV exports, media — get real object
storage (Amazon S3 underneath). Uploads and downloads work the way production
apps do it: your app mints a **secure, expiring link**, and the user's browser
transfers the file directly to storage. Large files never squeeze through your
app's own server.

## What this means for your app

* Users can upload files of any practical size; downloads are served through
  expiring signed links, so files aren't publicly listable.
* Files persist independently of the app — they survive restarts, sleeps, and
  new deploys.
* The agent can list, inspect, and clean up stored files while building ("delete
  the test uploads").

## Isolation

Every file your project stores lives under your project's own storage scope.
The scoping is applied at the platform boundary — your app physically cannot
read or write another project's files, and deleting a project's files affects
that project alone.

## Good to know

* Signed links expire (15 minutes by default, configurable up to 7 days) — this
  is a feature, not a bug: a leaked link goes stale.
* Storage is for files. API keys and credentials belong in
  [Secrets](/capabilities/secrets), which is encrypted and rotatable — the agent
  follows this rule and so should any code you add after
  [exporting](/shipping/export-github).
* Your app never holds cloud credentials; it requests links through the
  platform's runtime broker. That's also why the same code works identically in
  preview and production.