Compatibility
Cloak Object is designed for AWS Signature Version 4, multipart uploads, presigned URLs, private buckets, versioning, and lifecycle rules. Clients use the Cloak endpoint and path-style addressing rather than an AWS endpoint.
Encryption boundaries
TLS protects an object while it travels from your client to the Cloak gateway. The gateway must receive plaintext for ordinary S3 compatibility, then encrypts the object before the private storage layer receives it. Random object identifiers prevent that layer from receiving your bucket or object names.
This is not end-to-end encryption. If Cloak must never handle plaintext, encrypt the object in your own client before upload. Tools such as rclone crypt, restic, and application-level envelope encryption can provide that separate boundary.
Credentials and access
- Secret access keys are shown once; Cloak stores a verifier rather than displaying the secret again
- Keys can be scoped and revoked without changing unrelated credentials
- Buckets are private by default; presigned URLs grant time-limited access
- A leaked key or presigned URL should be revoked immediately
Metadata
The gateway processes account, bucket, object, request, size, timing, access-control, usage, and network metadata needed to authenticate requests, route data, bill usage, investigate failures, and prevent abuse. Client-side encryption protects content, but it does not hide all of this operational metadata.
Durability is not a backup promise
No storage service can promise that data will never be lost. Use versioning where appropriate, test restores, and keep an independent copy of critical data in a different failure domain.