diff --git a/opentech/apply/funds/models/submissions.py b/opentech/apply/funds/models/submissions.py
index d99656cf08d6e01b1e83722aec482e27a3e9d92d..811ee371bb330642fd2b52d926375fca35917198 100644
--- a/opentech/apply/funds/models/submissions.py
+++ b/opentech/apply/funds/models/submissions.py
@@ -4,7 +4,7 @@ from django.conf import settings
 from django.contrib.auth import get_user_model
 from django.contrib.postgres.fields import JSONField
 from django.core.exceptions import PermissionDenied
-from django.core.files.storage import default_storage
+from django.core.files.storage import DefaultStorage
 from django.core.serializers.json import DjangoJSONEncoder
 from django.db import models
 from django.db.models import ObjectDoesNotExist
@@ -39,6 +39,10 @@ from ..workflow import (
 )
 
 
+storage_settings = getattr(settings, 'APPLY_STORAGE_CONFIG', {})
+submission_storage = DefaultStorage(**storage_settings)
+
+
 class JSONOrderable(models.QuerySet):
     json_field = ''
 
@@ -302,7 +306,7 @@ class ApplicationSubmission(WorkflowHelpers, BaseStreamForm, AbstractFormSubmiss
 
     def save_path(self, file_name):
         file_path = os.path.join('submissions', 'user', str(self.user.id), file_name)
-        return default_storage.generate_filename(file_path)
+        return submission_storage.generate_filename(file_path)
 
     def handle_file(self, file):
         # File is potentially optional
@@ -313,11 +317,11 @@ class ApplicationSubmission(WorkflowHelpers, BaseStreamForm, AbstractFormSubmiss
                 # file is not changed, it is still the dictionary
                 return file
 
-            saved_name = default_storage.save(filename, file)
+            saved_name = submission_storage.save(filename, file)
             return {
                 'name': file.name,
                 'path': saved_name,
-                'url': default_storage.url(saved_name)
+                'url': submission_storage.url(saved_name),
             }
 
     def handle_files(self, files):
diff --git a/opentech/settings/base.py b/opentech/settings/base.py
index a1c0454510c658577ec5bfacebaccbeb9e5d3b53..0fec18577e34cd63f58f11d2cd9c3d39b02c2f36 100644
--- a/opentech/settings/base.py
+++ b/opentech/settings/base.py
@@ -375,5 +375,38 @@ else:
     CELERY_TASK_ALWAYS_EAGER = True
 
 
+# S3 configuration
+
+if 'AWS_STORAGE_BUCKET_NAME' in env:
+    DEFAULT_FILE_STORAGE = 'storages.backends.s3boto3.S3Boto3Storage'
+    AWS_STORAGE_BUCKET_NAME = env['AWS_STORAGE_BUCKET_NAME']
+    AWS_QUERYSTRING_AUTH = False
+    AWS_S3_FILE_OVERWRITE = False
+
+    if 'AWS_S3_CUSTOM_DOMAIN' in env:
+        AWS_S3_CUSTOM_DOMAIN = env['AWS_S3_CUSTOM_DOMAIN']
+
+    if 'AWS_S3_SECURE_URLS' in env:
+        AWS_S3_SECURE_URLS = (
+            env['AWS_S3_SECURE_URLS'].strip().lower() == 'true'
+        )
+
+    INSTALLED_APPS += (
+        'storages',
+    )
+
+    if 'APPLY_AWS_BUCKET_NAME' in env:
+        # Provide settings to access a secure bucket for apply documents
+        # Uses defaults from above if not provided
+        APPLY_STORAGE_CONFIG = {
+            'AWS_STORAGE_BUCKET_NAME': env['APPLY_AWS_BUCKET_NAME'],
+            'AWS_S3_SECRET_ACCESS_KEY': env['AWS_S3_SECRET_ACCESS_KEY'],
+            'AWS_S3_ACCESS_KEY_ID': env['AWS_S3_ACCESS_KEY_ID'],
+            'AWS_QUERYSTRING_AUTH': True,
+            'AWS_DEFAULT_ACL': 'private',
+            'AWS_BUCKET_ACL': 'private',
+        }
+
+
 MAILCHIMP_API_KEY = env.get('MAILCHIMP_API_KEY')
 MAILCHIMP_LIST_ID = env.get('MAILCHIMP_LIST_ID')
diff --git a/requirements.txt b/requirements.txt
index 4a5561150c9302752af377776340b269fe8ce696..744bf872f727c42d86077fc2c3e3c6dec6cf39e9 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -33,4 +33,5 @@ whitenoise==2.0.4
 uwsgi==2.0.15
 ConcurrentLogHandler==0.9.1
 raven==6.9.0
-mailchimp3==3.0.4
+django-storages==1.6.6
+mailchimp3==3.0.4
\ No newline at end of file