diff --git a/pkg/systemstorageclient/systemstorageclient.go b/pkg/systemstorageclient/systemstorageclient.go
new file mode 100644
index 000000000..bb87ee139
--- /dev/null
+++ b/pkg/systemstorageclient/systemstorageclient.go
@@ -0,0 +1,56 @@
+package systemstorageclient
+
+import (
+	"context"
+	"github.com/opencloud-eu/opencloud/pkg/log"
+
+	"github.com/opencloud-eu/reva/v2/pkg/storage/utils/metadata"
+)
+
+type SystemDataStorageClient struct {
+	mds *metadata.Storage
+}
+
+func (s SystemDataStorageClient) SimpleDownload(ctx context.Context, userID, identifier string) ([]byte, error) {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (s SystemDataStorageClient) SimpleUpload(ctx context.Context, userID, identifier string, content []byte) error {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (s SystemDataStorageClient) Delete(ctx context.Context, userID, identifier string) error {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (s SystemDataStorageClient) ReadDir(ctx context.Context, userID, identifier string) ([]string, error) {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (s SystemDataStorageClient) MakeDirIfNotExist(ctx context.Context, userID, identifier string) error {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (s SystemDataStorageClient) Init(ctx context.Context, userID, identifier string) error {
+	//TODO implement me
+	panic("implement me")
+}
+
+// NewProfileStorageClient creates a new ProfileStorageClient
+func NewSystemStorageClient(nameSpace string,
+	logger *log.Logger,
+	gatewayAddress, storageAddress, systemUserID, systemUserIDP, systemUserAPIKey string) SystemDataStorageClient {
+	sdsci := SystemDataStorageClient{}
+	logger.Debug().Msg("NewSystemStorageClient called")
+	sdsc, err := metadata.NewCS3Storage(gatewayAddress, storageAddress, systemUserID, systemUserIDP, systemUserAPIKey)
+	if err != nil {
+		logger.Fatal().Err(err).Msg("could not create profile storage client")
+	}
+	sdsci.mds = &sdsc
+	return sdsci
+}
diff --git a/services/graph/pkg/config/config.go b/services/graph/pkg/config/config.go
index 24491278d..ce5d1a16d 100644
--- a/services/graph/pkg/config/config.go
+++ b/services/graph/pkg/config/config.go
@@ -37,6 +37,8 @@ type Config struct {
 	ServiceAccount ServiceAccount `yaml:"service_account"`
 
 	Context context.Context `yaml:"-"`
+
+	SystemStorageClient SystemStorageClient `yaml:"system_storage_client"`
 }
 
 type Spaces struct {
@@ -153,3 +155,14 @@ type ServiceAccount struct {
 	ServiceAccountID     string `yaml:"service_account_id" env:"OC_SERVICE_ACCOUNT_ID;GRAPH_SERVICE_ACCOUNT_ID" desc:"The ID of the service account the service should use. See the 'auth-service' service description for more details." introductionVersion:"1.0.0"`
 	ServiceAccountSecret string `yaml:"service_account_secret" env:"OC_SERVICE_ACCOUNT_SECRET;GRAPH_SERVICE_ACCOUNT_SECRET" desc:"The service account secret." introductionVersion:"1.0.0"`
 }
+
+// SystemStorageClient configures the metadata store to use
+type SystemStorageClient struct {
+	GatewayAddress string `yaml:"gateway_addr" env:"SETTINGS_STORAGE_GATEWAY_GRPC_ADDR;STORAGE_GATEWAY_GRPC_ADDR" desc:"GRPC address of the STORAGE-SYSTEM service." introductionVersion:"1.0.0"`
+	StorageAddress string `yaml:"storage_addr" env:"SETTINGS_STORAGE_GRPC_ADDR;STORAGE_GRPC_ADDR" desc:"GRPC address of the STORAGE-SYSTEM service." introductionVersion:"1.0.0"`
+
+	SystemUserID     string `yaml:"system_user_id" env:"OC_SYSTEM_USER_ID;SETTINGS_SYSTEM_USER_ID" desc:"ID of the OpenCloud STORAGE-SYSTEM system user. Admins need to set the ID for the STORAGE-SYSTEM system user in this config option which is then used to reference the user. Any reasonable long string is possible, preferably this would be an UUIDv4 format." introductionVersion:"1.0.0"`
+	SystemUserIDP    string `yaml:"system_user_idp" env:"OC_SYSTEM_USER_IDP;SETTINGS_SYSTEM_USER_IDP" desc:"IDP of the OpenCloud STORAGE-SYSTEM system user." introductionVersion:"1.0.0"`
+	SystemUserAPIKey string `yaml:"system_user_api_key" env:"OC_SYSTEM_USER_API_KEY" desc:"API key for the STORAGE-SYSTEM system user." introductionVersion:"1.0.0"`
+	Cache            *Cache `yaml:"cache"`
+}
diff --git a/services/graph/pkg/config/defaults/defaultconfig.go b/services/graph/pkg/config/defaults/defaultconfig.go
index 62985ccbe..5c926c6ff 100644
--- a/services/graph/pkg/config/defaults/defaultconfig.go
+++ b/services/graph/pkg/config/defaults/defaultconfig.go
@@ -125,6 +125,17 @@ func DefaultConfig() *config.Config {
 		UnifiedRoles: config.UnifiedRoles{
 			AvailableRoles: nil, // will be populated with defaults in EnsureDefaults
 		},
+		SystemStorageClient: config.SystemStorageClient{
+			GatewayAddress: "eu.opencloud.api.storage-system",
+			StorageAddress: "eu.opencloud.api.storage-system",
+			SystemUserIDP:  "internal",
+			Cache: &config.Cache{
+				Store:    "memory",
+				Nodes:    []string{"127.0.0.1:9233"},
+				Database: "settings-cache",
+				TTL:      time.Minute * 10,
+			},
+		},
 	}
 }
 
diff --git a/services/graph/pkg/service/v0/graph.go b/services/graph/pkg/service/v0/graph.go
index dbcbef72b..4cc157163 100644
--- a/services/graph/pkg/service/v0/graph.go
+++ b/services/graph/pkg/service/v0/graph.go
@@ -3,6 +3,7 @@ package svc
 import (
 	"context"
 	"errors"
+	"github.com/opencloud-eu/opencloud/pkg/systemstorageclient"
 	"net/http"
 	"net/url"
 	"path"
@@ -67,6 +68,7 @@ type Graph struct {
 	keycloakClient           keycloak.Client
 	historyClient            ehsvc.EventHistoryService
 	traceProvider            trace.TracerProvider
+	sdsc                     systemstorageclient.SystemDataStorageClient
 }
 
 // ServeHTTP implements the Service interface.
diff --git a/services/graph/pkg/service/v0/photo.go b/services/graph/pkg/service/v0/photo.go
index 7bbee839a..6e18ddb6e 100644
--- a/services/graph/pkg/service/v0/photo.go
+++ b/services/graph/pkg/service/v0/photo.go
@@ -1,14 +1,19 @@
 package svc
 
 import (
-	"net/http"
-	"net/url"
-
 	userpb "github.com/cs3org/go-cs3apis/cs3/identity/user/v1beta1"
 	"github.com/go-chi/chi/v5"
 	"github.com/go-chi/render"
+	"github.com/opencloud-eu/opencloud/pkg/systemstorageclient"
 	"github.com/opencloud-eu/opencloud/services/graph/pkg/errorcode"
 	revactx "github.com/opencloud-eu/reva/v2/pkg/ctx"
+	"net/http"
+	"net/url"
+)
+
+var (
+	namespace  = "profilephoto"
+	identifier = "profilephoto"
 )
 
 // GetMePhoto implements the Service interface
@@ -42,10 +47,15 @@ func (g Graph) GetPhoto(w http.ResponseWriter, r *http.Request) {
 func (g Graph) getPhoto(w http.ResponseWriter, r *http.Request, u *userpb.UserId) {
 	logger := g.logger.SubloggerWithRequestID(r.Context())
 	logger.Debug().Msg("GetPhoto called")
+	g.getSystemStorageClient()
+	photo, err := g.sdsc.SimpleDownload(r.Context(), u.GetOpaqueId(), identifier)
+	if err != nil {
+		render.Status(r, http.StatusNotFound)
+		render.JSON(w, r, nil)
+	}
+	render.Status(r, http.StatusOK)
+	render.JSON(w, r, photo)
 
-	// TODO: use proper default return
-	render.Status(r, http.StatusNotFound)
-	render.JSON(w, r, nil)
 }
 
 // UpdateMePhoto implements the Service interface
@@ -79,8 +89,22 @@ func (g Graph) UpdatePhoto(w http.ResponseWriter, r *http.Request) {
 func (g Graph) updatePhoto(w http.ResponseWriter, r *http.Request, u *userpb.UserId) {
 	logger := g.logger.SubloggerWithRequestID(r.Context())
 	logger.Debug().Msg("UpdatePhoto called")
-
+	g.getSystemStorageClient()
+	g.sdsc.SimpleUpload(r.Context(), u.GetOpaqueId(), identifier, []byte("test"))
 	// TODO: use proper default return
 	render.Status(r, http.StatusForbidden)
 	render.JSON(w, r, nil)
 }
+
+func (g Graph) getSystemStorageClient() systemstorageclient.SystemDataStorageClient {
+	g.sdsc = systemstorageclient.NewSystemStorageClient(
+		namespace,
+		g.logger,
+		g.config.SystemStorageClient.GatewayAddress,
+		g.config.SystemStorageClient.StorageAddress,
+		g.config.SystemStorageClient.SystemUserID,
+		g.config.SystemStorageClient.SystemUserIDP,
+		g.config.SystemStorageClient.SystemUserAPIKey,
+	)
+	return g.sdsc
+}