Storage
S3-compatible object storage
Buckets that speak S3 to everything that already does.
Point the AWS CLI, boto3, rclone, restic or s3cmd at one endpoint and a key. Versioning, object lock, lifecycle rules and replication live in the bucket settings, the way they do on S3.
- API
- S3 · SigV4
- Addressing
- path-style
- Presigned URLs
- up to 7 days
- Keys
- bucket · prefix scoped
$ aws --endpoint-url https://s3.subnomic.com \ s3 cp db-2026-09-11.sql.gz s3://acme-db-dumps/nightly/ upload: ./db-2026-09-11.sql.gz to s3://acme-db-dumps/nightly/db-2026-09-11.sql.gz
How it works
A key, an endpoint, and the client you already have.
Create an access key
Scope it to buckets or a key prefix, and to any mix of read, write and delete — or leave it open to the whole workspace. Give it an expiry if you like. The secret is shown once.
$ aws configure AWS Access Key ID [None]: •••••••• AWS Secret Access Key [None]: •••••••• Default region name [None]: eu-west-1
Point the client at the endpoint
Path-style addressing, SigV4 in the header or in a presigned URL, and every aws-chunked streaming mode. A request for the wrong region is answered with the right one, so SDKs retry on their own.
$ aws --endpoint-url https://s3.subnomic.com \ s3 mb s3://acme-backups make_bucket: acme-backups
Use it like S3
Backups, build artefacts, uploads from a browser form. Multipart for large objects, range requests for partial reads.
$ restic -r s3:https://s3.subnomic.com/acme-backups init $ rclone sync ./dist sn:acme-cdn
Bucket settings
The parts of S3 you actually configure.
Versioning
Turn it on per bucket. A delete leaves a marker, and every earlier version stays until you remove it by id.
Object lock
Governance or Compliance, a default retention in days or years, and legal hold. Compliance retention can never be shortened, and a bucket holding locked versions cannot be deleted.
Lifecycle rules
Expire current or noncurrent versions after a number of days and abort stale multipart uploads, filtered by prefix or tags. Rules run hourly and never override a lock.
Replication
Copy a bucket asynchronously to any S3-compatible endpoint, optionally by prefix and with deletes if you opt in. Failed copies are kept and shown with their error rather than dropped.
Scoped access keys
Keys belong to the workspace, not to a person, so they keep working when somebody leaves. Scope by bucket, prefix and read / write / delete, with an optional expiry.
Public read and bucket policies
The public switch allows anonymous GET and HEAD only — nobody can list the bucket. For more, write an AWS-style policy with source IP, TLS, referer or user-agent conditions.
Presigned URLs and share links
Presigned GET and PUT for up to seven days. Share links are listed, revocable, and revoked automatically when the object is deleted.
Uploads from anywhere
Multipart up to 10,000 parts, POST Object for browser form uploads, and CORS rules per bucket.
Events that start workflows
A put, copy or delete can start a workflow — thumbnail an image, index a document, alert on an unexpected delete.
Compatibility
What is implemented, and what is refused.
Anything outside the list is refused with a clear S3 error instead of being silently accepted, so a client that depends on it fails loudly on day one rather than quietly in production.
Implemented
- ListBuckets, CreateBucket, DeleteBucket, HeadBucket, GetBucketLocation
- ListObjects v1 and v2, ListObjectVersions
- GetObject, PutObject, HeadObject, DeleteObject, CopyObject, DeleteObjects (1,000 keys)
- Range and conditional requests
- Multipart: create, upload part, upload part copy, complete, abort, list parts, list uploads
- CORS, bucket policy and policy status, versioning, lifecycle
- Object lock configuration, retention and legal hold; object tagging
- POST Object for browser form uploads; presigned GET and PUT
Refused, with an explicit error
- —ACLs — use bucket policies instead
- —Virtual-hosted-style addressing — path-style only
- —Storage classes, transitions, Intelligent-Tiering, Glacier restore
- —SSE-KMS and customer-supplied keys
- —S3 Select, inventory, analytics and access logging
- —Bucket tagging, public access block, ownership controls
Leaving
Standard API in, standard API out.
Because the product is the S3 API, the way out is the same tools you came in with. Nothing about your objects is stored in a format only we can read.
- Storage is deduplicated inside your workspace and never across workspaces.
- Replication can keep a live copy in another provider while you move.
- Bucket names are unique across all workspaces, and another workspace’s bucket simply returns 404.
$ aws --endpoint-url https://s3.subnomic.com \ s3 sync s3://acme-db-dumps ./acme-db-dumps download: s3://acme-db-dumps/nightly/db-2026-09-11.sql.gz …
Limits
What each plan includes.
| Plan | Free | Pro | Team | Enterprise |
|---|---|---|---|---|
| Stored | 512 MB | 20 GB | 100 GB | 1 TB |
| Objects | 1,000 | 50,000 | 250,000 | 2,500,000 |
| Buckets | 1 | 10 | 50 | 500 |
Stored bytes are shared with Sites. Object keys can be up to 1,024 bytes, and multipart parts other than the last must be at least 5 MB. The whole price list.
Questions
Before you move a backup job over.
Which clients work?
Anything that speaks SigV4 with path-style addressing: the AWS CLI, boto3 and the other AWS SDKs, rclone, restic and s3cmd. The AWS CLI is run against it as a conformance suite in CI.
How do I turn on path-style?
Set force_path_style = true in rclone, addressing_style: path in boto3, or the equivalent option in your SDK. The AWS CLI with --endpoint-url works as it is.
Can other workspaces see my objects?
No. Deduplication happens inside a workspace only, and a bucket is readable without a key only if you switch on public read or write a policy that allows it.
Can storage start a workflow?
Yes. Event rules on a bucket start a workflow on a put, copy, multipart completion or delete — up to 25 rules per bucket.
The rest of the workspace
Same bill, same credentials, same audit log.
An endpoint and a key, about a second from now.
Create a workspace, make a key, point your client at it. The free plan needs no card.