The most important feature of a storage product is the one you hope never to use: getting your data out again. If the way in is a proprietary SDK, the way out is a migration project.
The product is the API
Subnomic Storage speaks S3, with SigV4 and path-style addressing. The AWS CLI, boto3, rclone, restic and s3cmd work as they are, and the AWS CLI runs against it as a conformance suite. Leaving is a command you already know:
$ aws --endpoint-url https://s3.subnomic.com \
s3 sync s3://acme-db-dumps ./acme-db-dumpsReplication can keep a live copy in another S3-compatible provider while you move — asynchronously, optionally by prefix, and copying deletes only if you opt in. Copies that fail are kept and shown with their error rather than dropped.
Refuse, don’t fake
No S3-compatible service implements all of S3, and the dangerous ones pretend otherwise. An operation Subnomic doesn’t support — ACLs, storage classes, S3 Select, KMS-managed keys — returns an explicit error. A client that depends on it fails on day one, in your terminal, instead of misbehaving quietly in production.
The settings that matter for backups
- Versioning — a delete leaves a marker, and earlier versions stay until you remove them by id.
- Object lock — Governance or Compliance retention, plus legal hold. Compliance retention can never be shortened, and a bucket holding locked versions cannot be deleted.
- Lifecycle rules — expire noncurrent versions after a number of days and clean up stale multipart uploads, without ever overriding a lock.
Together they turn “we have backups” into backups that the job which wrote them cannot quietly delete.
Keys that unlock little
Access keys belong to the workspace, not to a person, so a backup job doesn’t break when somebody leaves. Scope a key to a bucket or a prefix and to read, write or delete, give it an expiry if it is for something short-lived, and copy the secret when it is shown — it is shown once.
Private unless you say otherwise
Deduplication happens inside your workspace and never across workspaces. A bucket is readable without a key only if you switch on public read — which allows GET and HEAD and still doesn’t allow listing — or write a bucket policy that says so.