S3-compatible. Sovereign by default.
A drop-in S3 endpoint at s3.skyeconnex.com. SigV4-signed, path-style addressing, multipart-aware. Every byte that lands in a bucket is encrypted client-side, framed, and scattered across your sovereignty constellation — without your application knowing or caring.
An S3 endpoint that happens to be sovereign.
SigV4 authorisation
Full AWS Signature Version 4 implementation. Region honoured in the credential scope. Reject mismatches the way AWS does — so SDK retry logic just works.
Path-style addressing
Buckets addressed as s3.skyeconnex.com/<bucket>/<key>. No DNS gymnastics, no virtual-hosted style required — though we accept that too.
Multipart over the stream pipeline
Large objects upload as multipart. Each part flows through the same chunked encrypt-frame-scatter pipeline the rest of SkyeConnex uses. Resumable, idempotent, retryable.
Per-bucket region honoured
The region in the SigV4 credential scope maps to a SkyeConnex residency policy. Move a workload between regions by re-signing — without touching the data.
UMK versioning on writes
Every write captures the active User Master Key version. Rotating the UMK never strands a previous object — reads transparently unwrap against the version they were written under.
Signed access reports
Every read and write becomes a row in the dual-signed access log (HMAC-SHA-256 + ML-DSA-87). Auditor pulls a date range, verifies offline against the issuer key.
Works with the tools your team already uses.
Cyberduck
Cross-platform GUI. Drag-and-drop, mounted-filesystem mode (Mountain Duck). Add the SkyeBucket endpoint as a custom S3 profile — everything else is familiar.
boto3 / aws-sdk
Set endpoint_url='https://s3.skyeconnex.com' and addressing_style='path'. The rest of your code is unchanged.
awscli
aws --endpoint-url=https://s3.skyeconnex.com s3 cp .... All standard subcommands. Bucket policy and ACL surface the SkyeConnex permission model.
rclone
Backend type s3, provider Other. Tested at petabyte scale for one-way sync, two-way sync, and copy operations.
Veeam Backup & Replication
Add SkyeBucket as an S3-compatible Object Storage Repository. Retarget existing backup jobs — the backup data inherits the sovereignty topology automatically.
AWS Backup
Cross-account, cross-region archive targets supported. Useful for orgs migrating off direct hyperscaler storage while keeping AWS Backup as the orchestration layer.
Three lines of configuration
Retargeting an S3-shaped workload is usually one configuration change. Here's what it looks like with boto3:
import boto3
from botocore.client import Config
s3 = boto3.client(
's3',
endpoint_url='https://s3.skyeconnex.com',
config=Config(s3={'addressing_style': 'path'}, signature_version='s3v4'),
region_name='ca-central-1',
aws_access_key_id='<your-key>',
aws_secret_access_key='<your-secret>',
)
s3.upload_file('local.bin', 'audit-archive', 'logs/2026-06.bin')
The bucket policy is enforced by SkyeConnex. The region is honoured in the SigV4 credential scope. Every object goes through the multi-cloud RAID pipeline. Your auditor gets a signed access log on request.
The Veeam retarget pattern
Veeam Backup & Replication has a first-class concept of an S3 Object Storage Repository. SkyeBucket appears as one. The setup is:
- Backup Infrastructure → Backup Repositories → Add Repository → Object storage → S3 Compatible.
- Service point: https://s3.skyeconnex.com. Region: your residency policy region. Credentials: SkyeConnex SigV4 key.
- Select the bucket. Veeam runs its capability probe (multipart, ACL, immutability). All pass.
Existing backup jobs can be edited to use the new repository as either the primary target or a copy target. There are no Veeam agent updates, no licence implications, and no operational pattern changes. The architectural sovereignty — encrypt-then-scatter across seven providers in your chosen jurisdictions — is inherited from the substrate.
What auditors actually want
Beyond standard S3 capability, three properties matter to auditors looking at backup architecture:
- Immutability — SkyeBucket exposes object versioning. Combined with the underlying topology, no single attacker can encrypt a versioned object across the constellation.
- Cryptographic boundary — the bucket-level encryption key is wrapped by the customer UMK. The platform cannot decrypt at rest.
- Audit trail — every API operation is logged and dual-signed. A subpoena, a legal hold, an accidental deletion — each leaves a verifiable record.
Point your S3 client at sovereign storage.
Your tooling stays the same. Your sovereignty story stops being a contract clause.