S3-Compatible Object Storage on Your Own Servers

Scope & Capabilities

S3-compatible buckets served from your own servers, kept on storage Syntoric runs on them or on S3-compatible storage you connect, with access control, quotas, monitoring and alerting.

• S3-compatible API: any S3 client, SDK or tool works with an endpoint and an access key, including presigned URLs, multipart uploads and checksums
• Run storage on your own Linux servers through Fleet Manager, with one or two extra copies of every object on other servers and capacity added server by server
• Or connect storage you already have: Amazon S3, Cloudflare R2, Backblaze B2, Wasabi, Google Cloud Storage, DigitalOcean Spaces, MinIO or Ceph, and adopt existing buckets
• The same access control, quotas, notifications, audit records and analytics on every kind of storage
• Access keys with grants per bucket and key prefix: read, write or both, with expiry and rotation
• Bucket and project quotas, enforced on every write
• Versioning, lifecycle rules (expire objects, delete old versions, abort incomplete uploads), CORS and public read per bucket
• Encryption in transit (TLS 1.3 on every endpoint, mutual TLS between your storage servers) and at rest
• Bring your own domain for the S3 endpoint with a Certificate Manager certificate, issued by Let's Encrypt or imported (virtual-hosted style needs a wildcard certificate, validated by DNS); otherwise the endpoint uses a certificate from your project's own CA
• Event notifications for object uploads and deletions, delivered to your webhooks and signed
• Usage monitoring: bucket sizes, objects, requests, errors, data transferred, with alert rules delivered to email, Slack, Microsoft Teams or webhooks
• Storage analytics: traffic and storage over time, by bucket and by operation, and the most downloaded objects
• Every write, delete and refused request kept as an access record, and every change recorded in the audit trail
• Managed Databases backups can be kept in a bucket
• Your objects stay on your servers or the storage you connect: they never pass through Syntoric