Your own S3 storage: Filarr syncs your encrypted files into your bucket.
Point Filarr at your own S3-compatible bucket: your synced files live with the provider you choose, end-to-end encrypted before they leave. Available on the Pro plan.
- Plan
- Pro
- Protocol
- S3-compatible, HTTPS
- Encryption
- AES-256-GCM, before upload
- Health probe
- Every 6 hours
01 — What the bucket sees
Your bucket can read nothing
Your devices
The keys, and the plaintext.
Your bucket
Encrypted chunks: no readable content, no key, no file name in clear text.
Encryption happens on your devices, before upload. Your bucket only ever receives AES-256-GCM blobs: no readable content, no key. A bucket administrator — you, your host, an auditor — can decrypt none of it. What any storage does observe: the number of objects and folders, their sizes, how they are chunked, the timing and frequency of syncs, and your account and profile identifiers in the prefix. Filenames are never written in clear text: the object identifier is derived from them by hashing. That derivation is unsalted, so someone who already knew a folder’s identifier — a former collaborator, an old backup — could test names inside it; nothing can be inferred from observing the bucket alone.
02 — Setting it up
Connect your bucket in three steps
01
Create a bucket
On Cloudflare R2, Amazon S3, Backblaze B2, Wasabi, Scaleway, OVHcloud… or any S3-compatible storage reachable over HTTPS from the internet. No CORS configuration needed.
02
Create a restricted key
Filarr hands you the exact IAM policy to paste, scoped to your prefix: the key can only touch your own objects, never the rest of the bucket.
03
Paste, test, migrate
Filarr probes the bucket before saving anything, then copies your existing data server-to-server, resumable. Your workspace stays usable during the copy.
03 — The guarantees
The hard rules
Encrypted before it leaves
Your files are encrypted on your devices before upload, and keys only leave wrapped. The Filarr server relays and verifies: it does not decrypt your files.
No silent fallback
An unreachable bucket is an error said to your face — never an invented “empty vault”, never a quiet switch to different storage.
Health monitored
As long as your bucket is reachable from the internet, the server probes it every 6 hours: latency, outage, revoked key. You hear about it before sync silently stops.
The exit stays open
Subscription lapsed? Your data stays readable for 30 days and copying back to Filarr Cloud stays available. Your bytes are never held hostage.
04 — The providers
Supported providers
Ready-made presets for the big names — and a custom-endpoint mode for any S3-compatible storage reachable over HTTPS from the internet.
- Cloudflare R2
- Amazon S3
- Backblaze B2
- Wasabi
- Scaleway
- OVHcloud
- Custom endpoint (S3-compatible, public HTTPS)
05 — The rest
Everything that comes with it
Assisted migration
For a bucket reachable from the internet: server-to-server copy in both directions, a check that every source object has its counterpart at the destination before anything is erased, resumes after interruption.
One bucket per profile
Each profile on the account can have its own target — personal profile on R2, work profile on the company bucket.
Organization bucket
On Teams and Enterprise, the organization’s shared vaults live on the company bucket, vault-by-vault migration included.
Compliance export
A signed document stating where every profile’s bytes live — hand it to an audit as-is.
IAM recipe included
The exact policy to paste at your provider, scoped to your prefix. No root keys in Filarr.
Guardrails
Probe before save, target-change quota shown before it bites, secret sealed server-side and never returned.
Your files, your bucket
BYOS is included in the Pro plan.