# Set up backup storage

> Create a storage bucket and an access key for your backups, with step-by-step instructions for Cloudflare R2, Backblaze B2, Amazon S3, Wasabi, DigitalOcean Spaces and other S3-compatible storage.

Source: https://rowsafe.sh/docs/guides/storage

Rowsafe keeps your backups in a storage bucket **that you own**. Rowsafe never stores your data itself, and it never sees the keys to your bucket: they stay on your database server.

You need three things:

1. **An empty, private bucket** just for Rowsafe.
2. **An access key** (an ID and a secret) that can read, write and delete files in that bucket.
3. **An encryption passphrase.** The installer can generate one for you.

The agent installer asks for these in your terminal and **tests the bucket before it finishes**, so you'll know right away if anything is wrong. You never paste keys into the Rowsafe dashboard.

> **Which provider should I pick?** If you don't have a preference, use **Cloudflare R2**: the first 10 GB are free and downloads (restores) cost nothing. Any provider below works the same way with Rowsafe.

## Cloudflare R2

### Create a bucket

In the [Cloudflare dashboard](https://dash.cloudflare.com), open **R2 Object Storage** and choose **Create bucket**. Give it a name such as `mycompany-rowsafe`. If your data must stay in the EU, set the location to **European Union (EU jurisdiction)**. Leave public access off.

### Create an access key

Still in R2, open **Manage API tokens** and choose **Create API token**. Pick **Object Read & Write**, and under "Specify bucket(s)" select only your new bucket. After you create it, keep the page open: it shows the **Access Key ID**, the **Secret Access Key** (only once) and your **account ID**.

### Run the installer

When the installer asks where to store backups, choose **Cloudflare R2** and paste the account ID, bucket name, access key ID and secret. Answer "yes" to the EU question if you created the bucket with the EU location.

## Backblaze B2

### Create a bucket

In your [Backblaze account](https://secure.backblaze.com/b2_buckets.htm), choose **Create a Bucket**. Make it **Private**. Note the **Endpoint** shown on the bucket, for example `s3.us-west-004.backblazeb2.com`: the part after `s3.` and before `.backblazeb2.com` is your region (`us-west-004`).

### Create an application key

Open **Application Keys** and choose **Add a New Application Key**. Allow access to **your new bucket only**, with **Read and Write** access. Copy the **keyID** and the **applicationKey**; the application key is shown only once.

### Run the installer

Choose **Backblaze B2** and enter the region, bucket name, keyID (as the access key ID) and applicationKey (as the secret).

## Amazon S3

### Create a bucket

In the [S3 console](https://console.aws.amazon.com/s3/), choose **Create bucket**, pick a region close to your database server, and keep **Block all public access** turned on.

### Create an access key for Rowsafe only

In IAM, create a user for Rowsafe (no console access) and attach a policy that allows only this bucket:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    { "Effect": "Allow", "Action": "s3:ListBucket", "Resource": "arn:aws:s3:::YOUR-BUCKET" },
    { "Effect": "Allow", "Action": ["s3:GetObject", "s3:PutObject", "s3:DeleteObject"], "Resource": "arn:aws:s3:::YOUR-BUCKET/*" }
  ]
}
```

Then create an **access key** for that user and copy the access key ID and secret.

### Run the installer

Choose **Amazon S3** and enter the bucket's region (for example `eu-central-1`), the bucket name, and the key.

## Wasabi

### Create a bucket

In the [Wasabi console](https://console.wasabisys.com), choose **Create Bucket** and pick a region. Keep it private.

### Create an access key

Create a sub-user for Rowsafe with programmatic access, give it a policy limited to this bucket (read, write, delete), and create an **access key** for it. Copy the key and secret.

### Run the installer

Choose **Wasabi** and enter the bucket's region (for example `eu-central-1`), the bucket name, and the key.

## DigitalOcean Spaces

### Create a Space

In the [DigitalOcean control panel](https://cloud.digitalocean.com/spaces), choose **Create a Spaces Bucket**, pick a datacenter region (for example `fra1`) and keep file listing restricted.

### Create an access key

Open **Spaces Object Storage > Access Keys** and create a key with read, write and delete access, limited to this bucket if you can. Copy the access key and secret.

### Run the installer

Choose **DigitalOcean Spaces** and enter the region slug (for example `fra1`), the bucket name, and the key.

## Other S3-compatible storage

Rowsafe works with any storage that speaks the S3 protocol over HTTPS: MinIO, Ceph, Hetzner Object Storage, OVHcloud Object Storage, Scaleway and others. Create a private bucket and an access key limited to it, then choose **Other S3-compatible storage** in the installer and enter the endpoint (for example `s3.example.com` or `s3.example.com:9000`), bucket name and key.

## The encryption passphrase

Backups are encrypted **on your server** before they're uploaded, so your storage provider only ever sees scrambled data. The installer offers to generate a strong passphrase and shows it **once**.

> **Save the passphrase in your password manager:** Without it, your backups can't be restored. Rowsafe doesn't have a copy and can't recover it. The installer asks you to type its last 4 characters to confirm you've saved it.

## Good to know

- **Use a dedicated, empty bucket** for Rowsafe. Don't share it with other files.

- **Don't add lifecycle or auto-delete rules** to the bucket. Rowsafe removes old backups itself, and a lifecycle rule could delete files that newer backups still depend on.

- **Keep the bucket private.** Rowsafe never needs public access.

- **Test your settings again** at any time on the server:

  ```sh
  curl -fsSL https://rowsafe.sh | sudo sh -s -- --check-storage
  ```

- **Change storage later** with `--setup-storage`. The installer offers to keep your existing passphrase, which your earlier backups still need.