Data and hosting 5 min read

Own storage, NAS and storage mounts in PaperOffice AI: the complete guide

Overview: two purposes for a storage mount

A storage mount connects PaperOffice AI to storage outside the PaperOffice data center. When you create one, you first choose its purpose. The purpose and the encryption cannot be changed after saving.

  • Use as BYOS-Storage: PaperOffice AI stores the files of a workspace encrypted on your own server or NAS. The storage target is SFTP or Reverse SSH.
  • Use as import source: the import wizard or a connector reads files from there and stores them in the PaperOffice data center. Possible connections are SFTP, Reverse SSH, Amazon S3, WebDAV, email (IMAP) and the scanner endpoint.

The same NAS may have two mounts, for example BYOS on the workspace folder and an import source on an export folder. How many storage mounts you can add depends on your plan.

Own Storage (BYOS): your files stay with you

You do not need PaperOffice Classic to keep documents on your own server. With Own Storage (BYOS), PaperOffice AI stores a workspace's files encrypted on your server or NAS. PaperOffice keeps only metadata and indexes.

  1. Open Document AI → Storage Mounts and click Add Storage Mount.
  2. Choose Use as BYOS-Storage, then SFTP or Reverse SSH.
  3. Set an Encryption Password with at least 16 characters and keep it safe.
  4. Test the connection and save.
  5. Create a new workspace under Document AI → Workspaces and choose Own Storage (BYOS) and your mount as storage.
  • Without the encryption password nobody can open the files, not even PaperOffice. If you lose it, there is no recovery, and you cannot change it later.
  • The storage location of a workspace is final once the workspace is created. Create the mount first.
  • Audit-proof archiving (WORM) is not available on your own storage, because the files remain deletable there.

Which protocol for which purpose

  • SFTP: for BYOS and as an import source.
  • Reverse SSH: for BYOS and as an import source. Your system opens an outbound tunnel to PaperOffice, so no inbound port forwarding is needed.
  • Amazon S3 and WebDAV, including Nextcloud, ownCloud or the WebDAV of a NAS: only as an import source. Imported files are then kept in the PaperOffice data center.
  • Email (IMAP): only as an import source for a mailbox.
  • Scanner endpoint: an upload point provided by PaperOffice for network scanners, used as an import source.

PaperOffice AI has no SMB or Windows-share connection type, and a mapped network drive is not a storage mount. Files from a network drive can be imported as a ZIP file. Cloud services such as OneDrive, SharePoint, Google Drive, Dropbox or Box are not available in the standard interface.

Prepare your NAS

PaperOffice AI has no separate connector for a NAS brand. The NAS is connected through a protocol, usually SFTP. Whatever the brand, you need:

  • the SFTP or SSH service switched on,
  • a dedicated user for PaperOffice,
  • a dedicated folder for PaperOffice, not the data folder of PaperOffice Classic and not its database.

In the app, PaperOffice AI signs in to SFTP with a password; an SSH private key can only be set through the API. The menus of the NAS firmware can differ slightly by version:

  • Synology (DSM): Control Panel → File Services, switch on the SFTP service.
  • QNAP (QTS): Control Panel → Network & File Services, allow SSH. SFTP runs over SSH.
  • ASUSTOR (ADM): switch on SSH/SFTP under Services, then create the user and the share under access control.

If you are moving from PaperOffice Classic, export the originals there first. The Classic data folder is not a storage target for PaperOffice AI.

Reachability: the test runs from the PaperOffice data center

The connection test does not run in your browser. It contacts your storage from the PaperOffice servers. A NAS that only answers on your local network, for example at an address starting with 192.168, is not reachable from there.

For SFTP, PaperOffice needs a public host name or public IP address, the SSH port open from outside (by default 22), the user, the password and the base folder. Local network addresses are rejected. If you cannot open a port, use Reverse SSH: your system opens an outbound tunnel to PaperOffice on port 443. In the dialog, enter the local SSH user and the local folder; the dialog then shows the setup commands to copy.

When the connection test fails

The test shows a specific message. The next step depends on that message, not on repeating the same values:

  • Host unreachable, port blocked or timeout: check the host name or public IP, the port and the firewall. A local address is not enough.
  • Connection refused or port closed: the SSH/SFTP service on the NAS is not running, or the port in the dialog is wrong.
  • Host not found: a typo in the name, or a DNS problem.
  • Authentication failed: check the user and the password.
  • Connection OK, but the folder cannot be read: check the base path and the read permission of the user.
  • SFTP subsystem could not be started: SSH answers, but SFTP is not enabled on the NAS.

Frequently asked questions

  • Do I need PaperOffice Classic to keep files on my own server? No. Use Own Storage (BYOS) in PaperOffice AI.
  • Can I connect a Windows share? No. Use SFTP or Reverse SSH, or import the files as a ZIP file.
  • Can I use S3 or WebDAV as my own storage? No. They are available only as an import source.
  • What happens if I lose the encryption password? The files can no longer be decrypted, not even by PaperOffice.
  • Can I switch a workspace to my own storage later? No. The storage location is fixed when the workspace is created.