Cloud Drives

Connect a cloud drive once and reuse it across your agents — read and write its files from a workflow, let a model browse it during a tool loop, ingest a folder into a knowledge base, or run an agent automatically whenever a file changes. Dropbox is supported today; the same vendor-neutral integration will cover more providers as they ship.

What a connection powers

A cloud-drive connection is set up once under Integrations → Cloud Drives and is shared across your account. Once connected, it drives four things — each with its full field reference on its own page:

• Cloud-drive steps — List Cloud Drive Folder, Read Cloud Drive File, and Write Cloud Drive File operate on a connection on demand inside a workflow.
• A cloud-drive tool on a prompt_call step, so the model itself can browse, read, and (optionally) write files during a tool loop — scoped to one connection and bounded by per-run caps.
• A cloud-drive content source — ingest a folder into a knowledge base, kept in sync as files are added or updated.
• Cloud file triggers — run an agent automatically when a file is added or updated, passing the changed file as the run input.

Steps bind a connection via their Cloud Drive Connection field, and paths and content support string substitutions — so a run can read {{metadata.file_path}} from a trigger or write to /reports/{{datetime UTC}}.txt.

Connecting a drive

1. Go to Integrations → Cloud Drives and add a connection (e.g. Dropbox).
2. Authorize access when redirected. The connection stays on your account and is reusable across agents, tools, sources, and triggers.
3. Reference it from a step's Cloud Drive Connection picker, a prompt_call cloud-drive tool, a content source, or a cloud file trigger.

If a drive later needs re-authorization, the connection is marked Error and the connection page shows a Reconnect required banner — reconnect it there.

Changing the connected Dropbox account

To point a connection at a different Dropbox account, disconnecting and reconnecting in Seclai isn't enough on its own: Dropbox remembers that you already authorized Seclai for the account you're signed into and will silently re-issue access to that same account — so the reconnect can complete without ever showing Dropbox's sign‑in screen. To switch accounts:

1. On the connection page, Disconnect (this revokes and deletes Seclai's stored Dropbox tokens for this connection).
2. In your browser, sign out of Dropbox — or, better, remove Seclai under Dropbox → Settings → Connected apps. This clears the remembered grant so the next authorization starts fresh.
3. Sign into the Dropbox account you want, then Reconnect. Seclai always requests Dropbox's approval screen on reconnect, so you can authorize with the intended account.

Transcription (audio & video)

Wherever a cloud-drive file is ingested — a Read Cloud Drive File step or a content source — audio and video files are transcribed, and the transcript becomes the file's text. A downstream step (or a knowledge-base search) then works with the spoken content even though no model plays media natively.

Transcription is metered as TRANSCRIPTION credits by the media's audio duration, the same rate as knowledge-base ingestion. In a read step it degrades gracefully if unavailable — the file still attaches, it just carries no transcript.

Privacy: transcription sends the file's audio to Seclai's transcription subprocessor (the same one used for knowledge-base ingestion). Only audio and video are sent; text, images, and documents are handled without it.

Credits and limits

• Step execution — listing, reading, and writing files make no model call, so the steps themselves consume no credits. A downstream prompt_call bills normally.
• Transcription — audio/video is metered as TRANSCRIPTION credits by audio duration. Text/document extraction and OCR are not billed.
• Size — reads and writes are bounded by max_file_mb (default: the 100 MB platform ceiling for steps). Oversized files are refused, not truncated.

Prompt injection & security

Files and filenames pulled from a drive are untrusted external content, so the List folder and Read file steps are treated as taint sources: their output (including extracted text and transcripts) is prompt-injection scanned before any downstream prompt_call, extract_data, or other consuming step runs. If the content is flagged unsafe, the consuming step is blocked and the scan appears as an Output Scan pseudo-step in the agent trace.

Connections use read-only, least-privilege access; downloads run only against the provider's fixed API host (a file path is never treated as a URL) and are size-capped. See Safety & Oversight for the platform-wide model.