Capabilities

An S3 endpoint that happens to be sovereign.

SigV4 authorisation

Full AWS Signature Version 4 implementation. Region honoured in the credential scope. Reject mismatches the way AWS does — so SDK retry logic just works.

Path-style addressing

Buckets addressed as s3.skyeconnex.com/<bucket>/<key>. No DNS gymnastics, no virtual-hosted style required — though we accept that too.

Multipart over the stream pipeline

Large objects upload as multipart. Each part flows through the same chunked encrypt-frame-scatter pipeline the rest of SkyeConnex uses. Resumable, idempotent, retryable.

Per-bucket region honoured

The region in the SigV4 credential scope maps to a SkyeConnex residency policy. Move a workload between regions by re-signing — without touching the data.

UMK versioning on writes

Every write captures the active User Master Key version. Rotating the UMK never strands a previous object — reads transparently unwrap against the version they were written under.

Signed access reports

Every read and write becomes a row in the dual-signed access log (HMAC-SHA-256 + ML-DSA-87). Auditor pulls a date range, verifies offline against the issuer key.

Validated clients

Works with the tools your team already uses.

Cyberduck

Cross-platform GUI. Drag-and-drop, mounted-filesystem mode (Mountain Duck). Add the SkyeBucket endpoint as a custom S3 profile — everything else is familiar.

boto3 / aws-sdk

Set endpoint_url='https://s3.skyeconnex.com' and addressing_style='path'. The rest of your code is unchanged.

awscli

aws --endpoint-url=https://s3.skyeconnex.com s3 cp .... All standard subcommands. Bucket policy and ACL surface the SkyeConnex permission model.

rclone

Backend type s3, provider Other. Tested at petabyte scale for one-way sync, two-way sync, and copy operations.

Veeam Backup & Replication

Add SkyeBucket as an S3-compatible Object Storage Repository. Retarget existing backup jobs — the backup data inherits the sovereignty topology automatically.

AWS Backup

Cross-account, cross-region archive targets supported. Useful for orgs migrating off direct hyperscaler storage while keeping AWS Backup as the orchestration layer.

Three lines of configuration

Retargeting an S3-shaped workload is usually one configuration change. Here's what it looks like with boto3:

import boto3
from botocore.client import Config

s3 = boto3.client(
    's3',
    endpoint_url='https://s3.skyeconnex.com',
    config=Config(s3={'addressing_style': 'path'}, signature_version='s3v4'),
    region_name='ca-central-1',
    aws_access_key_id='<your-key>',
    aws_secret_access_key='<your-secret>',
)
s3.upload_file('local.bin', 'audit-archive', 'logs/2026-06.bin')

The bucket policy is enforced by SkyeConnex. The region is honoured in the SigV4 credential scope. Every object goes through the multi-cloud RAID pipeline. Your auditor gets a signed access log on request.

The Veeam retarget pattern

Veeam Backup & Replication has a first-class concept of an S3 Object Storage Repository. SkyeBucket appears as one. The setup is:

  1. Backup Infrastructure → Backup Repositories → Add Repository → Object storage → S3 Compatible.
  2. Service point: https://s3.skyeconnex.com. Region: your residency policy region. Credentials: SkyeConnex SigV4 key.
  3. Select the bucket. Veeam runs its capability probe (multipart, ACL, immutability). All pass.

Existing backup jobs can be edited to use the new repository as either the primary target or a copy target. There are no Veeam agent updates, no licence implications, and no operational pattern changes. The architectural sovereignty — encrypt-then-scatter across seven providers in your chosen jurisdictions — is inherited from the substrate.

What auditors actually want

Beyond standard S3 capability, three properties matter to auditors looking at backup architecture:

  • Immutability — SkyeBucket exposes object versioning. Combined with the underlying topology, no single attacker can encrypt a versioned object across the constellation.
  • Cryptographic boundary — the bucket-level encryption key is wrapped by the customer UMK. The platform cannot decrypt at rest.
  • Audit trail — every API operation is logged and dual-signed. A subpoena, a legal hold, an accidental deletion — each leaves a verifiable record.

Point your S3 client at sovereign storage.

Your tooling stays the same. Your sovereignty story stops being a contract clause.