# Cloud Drives

Connect a cloud drive once and reuse it across your agents — read and write its
files from a workflow, let a model browse it during a tool loop, ingest a folder
into a knowledge base, or run an agent automatically whenever a file changes.
Dropbox is supported today; the same vendor-neutral integration will cover more
providers as they ship.

## What a connection powers

A cloud-drive connection is set up once under **Integrations → Cloud Drives** and
is shared across your account. Once connected, it drives four things — each with
its full field reference on its own page:

- **Cloud-drive steps** — [List Cloud Drive Folder](https://seclai.com/docs/agent-steps/integration#list-cloud-drive-folder-step),
  [Read Cloud Drive File](https://seclai.com/docs/agent-steps/integration#read-cloud-drive-file-step),
  and [Write Cloud Drive File](https://seclai.com/docs/agent-steps/integration#write-cloud-drive-file-step)
  operate on a connection on demand inside a workflow.
- **A cloud-drive tool** on a [`prompt_call`](https://seclai.com/docs/tools#cloud-drive-tools) step,
  so the model itself can browse, read, and (optionally) write files during a tool
  loop — scoped to one connection and bounded by per-run caps.
- **A cloud-drive content source** — [ingest a folder](https://seclai.com/docs/content-sources#cloud-drives)
  into a knowledge base, kept in sync as files are added or updated.
- **Cloud file triggers** — [run an agent](https://seclai.com/docs/agent-triggers#cloud-file-triggers)
  automatically when a file is added or updated, passing the changed file as the
  run input.

Steps bind a connection via their **Cloud Drive Connection** field, and paths and
content support [string substitutions](https://seclai.com/docs/agent-steps) — so a run can read
`{{metadata.file_path}}` from a trigger or write to `/reports/{{datetime UTC}}.txt`.

## Connecting a drive

1. Go to **Integrations → Cloud Drives** and add a connection (e.g. Dropbox).
2. Authorize access when redirected. The connection stays on your account and is
   reusable across agents, tools, sources, and triggers.
3. Reference it from a step's **Cloud Drive Connection** picker, a `prompt_call`
   [cloud-drive tool](https://seclai.com/docs/tools#cloud-drive-tools), a
   [content source](https://seclai.com/docs/content-sources#cloud-drives), or a
   [cloud file trigger](https://seclai.com/docs/agent-triggers#cloud-file-triggers).

If a drive later needs re-authorization, the connection is marked **Error** and
the connection page shows a **Reconnect required** banner — reconnect it there.

## Changing the connected Dropbox account

To point a connection at a **different Dropbox account**, disconnecting and
reconnecting in Seclai isn't enough on its own: Dropbox remembers that you
already authorized Seclai for the account you're signed into and will silently
re-issue access to **that same account** — so the reconnect can complete without
ever showing Dropbox's sign‑in screen. To switch accounts:

1. On the connection page, **Disconnect** (this revokes and deletes Seclai's
   stored Dropbox tokens for this connection).
2. In your browser, **sign out** of Dropbox — or, better, remove Seclai under
   **Dropbox → Settings → Connected apps**. This clears the remembered grant so
   the next authorization starts fresh.
3. Sign into the Dropbox account you want, then **Reconnect**. Seclai always
   requests Dropbox's approval screen on reconnect, so you can authorize with the
   intended account.

## Transcription (audio & video)

Wherever a cloud-drive file is ingested — a [Read Cloud Drive File](https://seclai.com/docs/agent-steps/integration#read-cloud-drive-file-step)
step or a [content source](https://seclai.com/docs/content-sources#cloud-drives) — audio and video
files are **transcribed**, and the transcript becomes the file's text. A
downstream step (or a knowledge-base search) then works with the spoken content
even though no model plays media natively.

Transcription is **metered** as `TRANSCRIPTION` credits by the media's audio
duration, the same rate as knowledge-base ingestion. In a read step it degrades
gracefully if unavailable — the file still attaches, it just carries no
transcript.

> **Privacy:** transcription sends the file's audio to Seclai's transcription
> subprocessor (the same one used for knowledge-base ingestion). Only audio and
> video are sent; text, images, and documents are handled without it.

## Credits and limits

- **Step execution** — listing, reading, and writing files make no model call, so
  the steps themselves consume no credits. A downstream `prompt_call` bills
  normally.
- **Transcription** — audio/video is metered as `TRANSCRIPTION` credits by audio
  duration. Text/document extraction and OCR are not billed.
- **Size** — reads and writes are bounded by `max_file_mb` (default: the 100 MB
  platform ceiling for steps). Oversized files are refused, not truncated.

## Prompt injection & security

Files and filenames pulled from a drive are **untrusted external content**, so
the [List folder](https://seclai.com/docs/agent-steps/integration#list-cloud-drive-folder-step) and
[Read file](https://seclai.com/docs/agent-steps/integration#read-cloud-drive-file-step) steps are
treated as taint sources: their output (including extracted text and transcripts)
is [prompt-injection scanned](https://seclai.com/docs/prompt-scanner#output-scanning) before any
downstream `prompt_call`, `extract_data`, or other consuming step runs. If the
content is flagged unsafe, the consuming step is blocked and the scan appears as
an **Output Scan** pseudo-step in the [agent trace](https://seclai.com/docs/agent-traces).

Connections use **read-only, least-privilege** access; downloads run only against
the provider's fixed API host (a file path is never treated as a URL) and are
size-capped. See [Safety & Oversight](https://seclai.com/docs/safety-overview) for the
platform-wide model.