Store documents in your own Cloudflare R2 bucket
Keep uploaded documents in a Cloudflare R2 bucket your company owns: what changes, how to connect it, health checks, moving documents in and out.
By default Ferrylend stores your uploaded documents (deal and merchant documents, bank statements, signed contracts, application uploads) encrypted on its own servers. With the Bring your own storage (R2) add-on, new documents go to a Cloudflare R2 bucket in your own Cloudflare account instead. The price is on the pricing page; Cloudflare bills you for the storage.
What changes and what does not
| With your own bucket | |
|---|---|
| Document files | Stored in your bucket, under a ferrylend/ folder, as random file names that say nothing about the document. |
| Encryption | Ferrylend encrypts every file with your organization's own key before it leaves our servers. Anyone with access to the bucket alone, including Cloudflare and your own bucket admins, sees only ciphertext. Ferrylend holds that key, so this is not a setup where we cannot read your documents. |
| Opening a document | Always through Ferrylend: we read the file from your bucket, check it was not changed or swapped, decrypt it and stream it to you. There are no public or shared links to the bucket. |
| Database, search, extracted text, parsed statement rows | Stay with Ferrylend, as before. |
| Backups of the files | Your responsibility. Ferrylend no longer keeps a copy of documents that live in your bucket. |
1. Create a bucket
- 1In the Cloudflare dashboard open R2 Object Storage → Create bucket.
- 2Name it (for example acme-documents) and pick the location. If you need EU or FedRAMP data residency, choose that jurisdiction now: it cannot be changed later.
- 3Leave public access off: do not enable the r2.dev URL or connect a custom domain. Use this bucket only for these documents.
2. Create an API token for that bucket
- 1In R2 open Manage API tokens → Create Account API token. An account token keeps working when someone leaves your team.
- 2Permission: Object Read & Write. Under Specify bucket(s), choose Apply to specific buckets only and pick your new bucket.
- 3Create it, then copy the Access Key ID and the Secret Access Key. Cloudflare shows the secret once.
3. Recommended bucket settings
- A lifecycle rule that aborts incomplete multipart uploads after 1 day.
- No CORS rule: your browser never talks to the bucket directly.
- Never delete or edit anything in the ferrylend/ folder outside the app.
4. Connect it
- 1Open Settings → Security → Document storage.
- 2Enter your Cloudflare account ID (32 characters, on the R2 overview page), the bucket name, its jurisdiction, the Access Key ID and the Secret Access Key, and tick the two confirmations.
- 3Click Test and connect. We write an encrypted test file, read it back, check it decrypts, delete it, check the bucket is not public and check what the token can reach. Nothing is saved unless every step passes.
If a check fails you see why in plain language (for example a wrong secret, a bucket in another jurisdiction, or a token without Object Read & Write). If the token can see other buckets, has Admin rights, or the bucket holds other files, you get a warning: create a narrower token or a dedicated bucket.
The secret is stored encrypted with your organization's key and is never shown again. To change it, use Replace credentials: the new pair is tested before the old one is replaced. Then revoke the old token in Cloudflare.
Moving existing documents
Connecting only changes where new documents go. To move the ones you already have, click Move existing documents to your bucket. Each file is copied, read back and checked (size, checksum, full decryption) before our copy is deleted; a file that does not check out stays where it was and is listed. You can keep working while it runs, and the progress shows on the same page.
Our nightly backups keep the old copies until those backups age out, up to about 6 months. Ask support if you need them purged sooner.
Health checks and outages
Every 5 minutes we read a small check file from your bucket, and once a day we write one. If the bucket stops answering (or the token is revoked, or the bucket is deleted), owners get an email and everyone sees a banner. While it is down, uploads are paused and stored documents cannot be opened; the rest of the app keeps working. We never fall back to storing your documents on our servers. When the bucket answers again, everything resumes by itself.
Applications from your online application link still arrive while the bucket is down: the lead, its details and the consent are saved, but the bank statements the applicant attached are not kept anywhere. The applicant is told on the confirmation screen to email them to the assigned rep (or the first owner), the lead gets a note and a call task saying the statements did not arrive, and owners get an email.
Disconnecting
In Document storage click Disconnect. The recommended way moves every document back to Ferrylend first (verified the same way) and then disconnects; you can also have each file deleted from your bucket once its copy is back. Disconnecting right away leaves the documents in your bucket, and they can no longer be opened in Ferrylend.
If you delete the bucket or revoke the token before moving documents back, Ferrylend cannot recover those documents.