Skip to content

BYOSA: Bring Your Own Storage Account

BYOSA lets a paying customer point AppGantry at a storage account they own and pay for. Build artifacts upload directly to that account, download directly from it, and never touch our infrastructure beyond the metadata row in our database.

Available on Business: not Team. (An Enterprise tier is not generally available yet; see Plans & pricing.)

For step-by-step Azure configuration, see the BYOSA setup guide.

What BYOSA gives you

1. A flat bill

Per-MB metering drops off your AppGantry invoice. You pay the platform fee on our side and your cloud provider's actual storage and egress rates on theirs. There is no AppGantry margin in the middle on the bytes.

2. Compliance

Some customers (finance, healthcare, government) can't let build artifacts (their unreleased apps!) live in another tenant's storage. BYOSA gives you tenancy isolation on the artifact data while we still run the metadata + control plane.

3. Geography

Pin your storage account to a specific Azure region for data residency. Our default hosted account lives in one region; yours can be anywhere Azure offers Blob Storage.

How it works

sequenceDiagram
  participant Dev as Developer / CI
  participant AG as AppGantry API
  participant ST as Your Azure Storage
  participant T as Tester
  Dev->>AG: initiate upload
  AG-->>Dev: signed direct-upload URL (to ST)
  Dev->>ST: PUT artifact (direct)
  Dev->>AG: complete upload (+ SHA-256)
  AG->>ST: check stored blob
  AG-->>Dev: build ready
  T->>AG: request install
  AG-->>T: signed download URL (to ST)
  T->>ST: GET artifact (direct)

The artifact bytes never cross AppGantry's edge. Only metadata, signed-URL requests, and the upload-completion call do. The upload sequence itself is exactly the same two-phase flow as on hosted storage: only the storage account behind the signed URL changes.

Onboarding, at a glance

BYOSA onboarding is a request-and-review workflow, not a switch you flip:

  1. You prepare an Azure subscription, resource group, storage account, and container, and grant AppGantry's application access.
  2. You submit an onboarding request from the organization's storage settings.
  3. AppGantry validates the request automatically and a person reviews it.
  4. Once approved, AppGantry completes activation with you.

The request moves through visible states — pending, validated, approving, approved, and the failure states rejected and validation failed — and you can withdraw a request and resubmit while it is still open. The full walkthrough is in the BYOSA setup guide.

What an org gives up

Mostly, predictability of the bill is replaced by predictability of the ceiling: you control the storage account, so you control retention, redundancy class, region, and cost.

Concern Hosted BYOSA
Bill Platform fee + per-MB usage Platform fee flat; cloud bill at your provider
Redundancy AppGantry's choice Your choice
Region AppGantry's default region Your choice
Mid-life migration Not needed (already on hosted) Assisted; not a self-serve switch
Disaster recovery AppGantry's account failover Yours

Trade-offs to know

  • BYOSA is Business only: not Team.
  • An org is fully hosted or fully BYOSA: there is no mixed mode and no per-project selection.
  • Mid-life migration (hosted → BYOSA after you've shipped builds) is handled with you rather than as a self-serve flip, because existing artifacts have to be accounted for.
  • Azure Blob Storage is what BYOSA supports today. If another cloud is a blocker, contact us.
  • Customer-managed encryption keys on top of BYOSA are transparent to AppGantry. That's your storage account's responsibility.

Security boundary

  • AppGantry authenticates into your tenant through an application you consent to once. No credentials of yours are shared with or stored by AppGantry.
  • The grant is scoped to one container in one storage account that you create for the purpose. Nothing else in the storage account, and nothing elsewhere in your subscription, is reachable.
  • Activation is assisted. You submit an onboarding request and AppGantry completes activation with you; there is no self-serve endpoint that switches an organization's storage backend.
  • After activation you can re-run diagnostics at any time from the organization's storage settings to confirm the connection is healthy.

See Security & disclosure for AppGantry's wider security posture and how to report a vulnerability.

See also