Security capabilities that go far beyond basic object storage, built in, not bolted on.
SHA-256 Hash-Chained Audit Log
Every action (uploads, deletes, ACL changes, approvals, policy edits) is written to a per-tenant audit chain where each entry hash-links to the previous one. Verify the chain end-to-end on demand; any insert, delete or edit shows as a hash mismatch. Filter by event type, actor, resource or date and export the full trail as CSV or JSONL with actor IDs resolved to display names.
DLP Scanning & Quarantine
Built-in and tenant-custom rules scan content on upload. Each violation is recorded with the matched pattern, severity (critical/high/medium/low) and category. Policies run in monitor or block mode and matched objects can be auto-quarantined; operators resolve violations and optionally release the quarantine, all of it audited.
Ransomware Shield
Real-time detection of bulk-delete patterns, bulk-overwrite patterns and anomalous delete-rate spikes against configurable thresholds. Triggered objects are auto-placed into protective holds (default 72 hours) so they can be recovered. Webhook notifications fire on each event and operators can review the threat feed and manually release holds.
Compliance Vault (WORM)
Two retention modes: compliance (cannot be reduced once locked) and governance (admin can extend), plus indefinite legal holds for litigation. Locked policies cannot be modified without an audit-logged unlock. Objects under retention or hold are blocked from deletion until retention expires.
Smart Tiering & Cost Modelling
Lifecycle transitions across Standard, Standard-IA, Glacier and Deep Archive based on last-access time, with prefix and size exclusions. Pluggable cost model (AWS pricing default), daily cost snapshots per storage class, and a preview that shows projected savings before you commit a policy.
Point-in-Time Recovery
Roll any bucket back to a past state, scoped to the whole bucket, a prefix, or a single object. A timeline view shows recovery points within the configurable protection window; preview the change set (what will be restored, deleted or modified) before launching an async recovery job whose status, progress and result are tracked.
Cross-Tenant ACL Approvals & Delegation
Grant object-level access across tenants without sharing credentials. Each request shows the owner the object metadata, DLP violation summary, active quarantine status and recent audit history before they approve or reject. Tenant admins can delegate approval authority to nominated users with explicit valid-from / valid-until windows; every transition is hash-chained into the audit log.
S3 Object Lambda
Transform objects on read with tenant-defined functions: redact PII, convert formats, compress or watermark (resize coming soon). Transformations are transparent to the S3 client and every invocation is logged for audit.
Geo-Fencing & Data Sovereignty
Restrict bucket access by IP geolocation or explicit IP-to-country mappings. Whitelist allowed regions or block specific countries; every blocked request is recorded with source IP, country and the action taken so you can prove residency enforcement.
Batch Operations
S3-style batch jobs across prefixes, tag filters or explicit object lists: copy, tag, and change storage class (batch ACL and retention changes coming soon). Per-item status (succeeded/failed) is tracked, results are written to a manifest bucket and the job report is auditable.
Access Heatmap with Drill-Down
Day-of-week × hour-of-day heatmap of access activity, colour-coded by intensity. Click any cell to see the top users, operations and buckets for that hour, or stream the underlying entries straight out as CSV or JSONL. Usernames are resolved to display names so the export is forensics-ready out of the box.
Enhanced Presigned URLs
Policy-driven presigned URLs with IP whitelists, country whitelists, prefix or per-key scope, expiration, rate limits and per-operation restrictions (GET vs PUT). Token usage analytics (hits, denials and bytes served) are recorded against each token.