---
title: Data Sources
sidebar:
  label: Overview
description: Where session data is kept — storage you own, connected from SuperAlign's backend.
---

_[console.superalign.ai/hub](https://console.superalign.ai/hub) → **Data Sources**_

A **data source** runs in SuperAlign's backend, not on an endpoint. It is the pair to [AI Tools](/surface/hub/ai-tools/overview), which run on the endpoint and decide what is collected in the first place.

Every data source is **off** until someone configures it. Unlike AI Tools, none of them start on: each needs credentials for a service you own, so there is nothing for Surface to enable on your behalf.

A data source decides where session data is kept. By default, recorded sessions are stored by SuperAlign for 30 days; a data source changes that.

| Extension | Role | What it means |
| --- | --- | --- |
| [Amazon S3](/surface/hub/data-sources/s3) | **Primary store** | Session data goes only to your bucket. The console reads it back from there. Retention is your bucket's lifecycle policy |
| [Splunk](/surface/hub/data-sources/splunk) | **Copy** | Every session message is also sent to your Splunk index. SuperAlign keeps its copy too |

To pull sessions from cloud agent platforms such as Microsoft Copilot Studio, see [Cloud Agents](/surface/hub/cloud-agents); its cards open the same panel described below.

## How configuration works

Click an extension's card in Hub. A panel opens on the right:

- An **Enabled** switch, and a status: **Not connected**, **Connected**, or **Disabled**.
- **Required fields** at the top. **Advanced options** folded below; you rarely need them.
- **Secret fields** (keys, tokens). Once saved, a secret is never shown again: the field shows dots, and the eye icon reveals only its last four characters. Click the pencil to replace it, or the bin to remove an optional one.
- **Test Connection** tries your values against the real service and tells you which step failed.
- **Save** stores the settings. The first Save also turns the extension on. **Cancel** closes the panel, and asks first if you have unsaved changes.

You cannot turn the switch on until the required credentials are saved. A card that is on but missing a required credential shows **\*API key not configured**.

Credentials are encrypted, tied to your organization, and never returned by any screen or API.

## Turning one off

Open the card and turn **Enabled** off. Surface stops sending data, or stops pulling it. Data already in your bucket, your index, or Surface stays there. Settings are kept, so you can turn it back on later.