Object Storage

Connect a bucket you own. Taliiq writes only to the paths you grant and never deletes your objects. Session exports land here today as a transcript, system events and a metadata file, organized by day, then agent or squad, then session.

Dashboard path: Settings → Storage (the same providers also appear as cards under Manage → Integrations)

You own the bucket. Encryption at rest, retention, region, access control and any compliance agreement with your storage provider (for example a BAA for healthcare data) are your responsibility. Taliiq only writes to the bucket and never deletes anything in it.

Supported providers

You can connect several buckets. They form a delivery chain (see Several buckets and fallback).

What gets delivered

For every finished session that has a log entry (voice calls, widget chat, email, campaigns, squads and test runs):

{prefix}/2026/09/29/{agent-or-squad-name}-{short-id}/{session-id}/
  recording.ogg
  transcript.json
  events.jsonl
  meta.json

• The date is the session start in UTC.
• The folder name is the agent or squad name plus a short id, so renaming an agent never splits its history.
• recording.ogg is the voice recording when recording is enabled for the agent (chat-only sessions skip it).
• transcript.json holds the conversation turns.
• events.jsonl holds one system event per line (tool calls, handoffs, errors).
• meta.json holds the session id, agent or squad id, channel, start and end time, duration, ended reason and a SHA-256 hash for every other file, so you can verify a file was not changed after delivery. It never includes prompts, provider keys, internal logs or cost breakdowns.

meta.json never includes customer phone numbers, contact details or structured output. The transcript and events are exported exactly as they are stored in Observe, so they contain what was said in the session.

The connect form shows a live example path for the prefix you type.

Connect a bucket

Only workspace owners and admins can create, change, reorder, test or delete a storage connection, and never while a support user is impersonating your account. Every change is written to the audit log and raises a notification for owners and admins, because a storage connection decides where your conversation data goes.

Least-privilege permissions

Taliiq needs to write objects. It does not need to list, overwrite existing session files or delete anything.

AWS S3

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:PutObject"],
      "Resource": "arn:aws:s3:::YOUR_BUCKET/YOUR_PREFIX/*"
    }
  ]
}

Add s3:GetObject on the same resource only if you want the Test connection button to confirm read access. Read is optional.

Google Cloud Storage

Grant the service account a role that contains storage.objects.create on the bucket (for example a custom role with only that permission). Add storage.objects.get only if you want the read check.

Azure Blob

Use a connection string for a storage account or a shared access signature that allows Create and Write on the container. Do not grant Delete.

Cloudflare R2

Create an R2 API token scoped to the single bucket with Object Write. Read is optional.

Taliiq sends a .taliiq/health-check file to test the connection. It overwrites that one fixed file and never needs delete permission.

AWS S3 (STS)

Instead of storing an access key, you create an IAM role that Taliiq is allowed to assume. Taliiq requests short-lived credentials (one hour at most) limited to writing under the session's folder.

The connect form shows a trust policy with an ExternalId unique to your workspace. Copy it into the role's trust relationship:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": { "AWS": "arn:aws:iam::TALIIQ_ACCOUNT_ID:role/TALIIQ_ROLE" },
      "Action": "sts:AssumeRole",
      "Condition": { "StringEquals": { "sts:ExternalId": "YOUR_EXTERNAL_ID" } }
    }
  ]
}

The ExternalId prevents another Taliiq customer from pointing Taliiq at your role.

Several buckets and fallback

Open Settings → Storage to see every connection in one list. Drag the rows, or use the arrows, to set the default order.

• Agents on Default use the first enabled and healthy connection in the list and fall back down when a write fails. Agents pinned to one connection skip this order and never fall back to another bucket.
• Use the switch on a row to turn a connection off without deleting it. Turning a connection off never needs a working bucket, but it is refused while an agent is set to use that connection (see Per-agent controls). Turning a connection on is always allowed.
• The Test button on a row runs the connection test again and shows each step: reach the endpoint, write a file, read it back.
• A connection that fails is marked unhealthy and skipped for Default delivery. A background check tests it again and puts it back in the chain when it passes.
• If every connection fails (or a pinned connection keeps failing), the export is marked failed, owners and admins get an alert, and the session data stays in Taliiq. Press Retry export on the session, or wait for the automatic retries.

Per-agent controls

Agent → Advanced → Storage chooses where this agent delivers and what is sent.

Storage connection (first control):

• An unhealthy connection is greyed out and cannot be newly chosen. Changing the connection (including Off or Default) asks you to confirm first. Files already delivered stay where they are.
• If the chosen connection is later switched off, the agent's sessions are not delivered until you choose another one, and the session shows why. A connection that an agent uses cannot be switched off or deleted until you change that agent. The same holds for a squad, through its member agents, and for inactive agents. The row on Settings → Storage lists the agents that use it, with a link to each one.

Two switches control what is written when delivery is on (both on by default):

A squad session follows the most restrictive setting among all its member agents. If one member has logging off, the squad session is not delivered. If the members choose different specific connections, the squad session is not delivered either, so set the same connection on every member (or leave them on Default).

The controls are disabled with an explanation when you have no connection or when your workspace uses zero data retention.

Data protection modes

Agents can turn recording, logs or transcript off under Advanced → Storage. Pinned connections never fall back to another bucket.

Retention and your files

Taliiq deletes its own copy of a session when your Observe retention period ends. Files already delivered to your bucket stay there. Taliiq never deletes or expires objects in your bucket, so you decide the lifecycle. Use your provider's lifecycle rules, and enable bucket versioning or Object Lock if you need tamper resistance.

After Taliiq purges a session, the session no longer appears in the Observe view. Use your own tools to read the delivered files.

Security model

Suspending or deleting a workspace stops delivery and removes the stored connections.

Audit log

Every change to storage is written to Observe → Audit Log, with who did it and when. Secrets are never recorded.

Troubleshooting