Storage configurations



When you integrate with Labelbox, you have 3 deployment models to choose from: Cloud, Hybrid Cloud (Standard & IAM Delegated Access), and Customer-managed infra. The deployment model you choose will determine where your assets will live.

IAM Delegated Access allows you to securely and seamlessly host your labeling assets while providing the Labelbox application with the limited access it needs. You can store your assets in an AWS S3, GCP, or Azure buckets and use native Identity and Access Management (IAM) roles and policies to control access.

Importing a dataset via the pre-signed URLs method involves creating signed (or public) URLs to each file and importing them to Labelbox.


When you import your data directly to the Labelbox cloud, it is stored on Labelbox servers, giving Labelbox access to your data. Labelbox stores your data and annotations in private buckets in Google Cloud Services.

To display assets in the browser interface, Labelbox generates signed URLs for each file, then loads the assets in the Editor. The standard expiration value for these signed URLs is 1 day. Labelers on your team only have access to the labels they create and to the asset URLs in their label queue.

Labelbox adheres to strict security measures to ensure all of your data is encrypted at rest and in transit.

Customer-managed infra

When you install Labelbox customer-managed infra, Labelbox does not have any access to your assets or annotation data. While Labelbox can provide you with guidance for configuring a Labelbox workforce with a customer-managed infra deployment, we are not able to provide you with the security services offered with the cloud or hybrid cloud solutions when you connect a workforce. For users that have security requirements to protect highly sensitive data, an air-gapped version of the customer-managed infra installation is available.