Technical Guide — PUCE Storage

Where does PUCE Storage fit?

Engine vs Storage. Backup tools vs the storage layer. S3 compatibility and limits. How it compares. Only what exists and is proven today.

1. PUCE Engine vs PUCE Storage

They are two distinct products. The Engine compresses; Storage stores. Storage’s S3 access neither compresses nor deduplicates.

PUCE Engine

Lossless compression product. This is where PUCE compression for data lives; it is documented on its own page.

What it doesCompresses data losslessly

Used forReducing data volume before sending it wherever it is stored

PUCE Storage

S3 object storage, encrypted by the gateway before it is stored, with immutable versions. A product separate from the Engine.

What it doesReceives S3 requests → encrypts (AES-256-GCM, 64 KiB blocks) → stores with versions and Object Lock → meters the bytes stored

InterfaceS3 API (path-style, SigV4); buckets and credentials in the reseller portal

Used forS3 target for backups and archive with per-object retention

Provided byReseller: provisions the customer and issues the credentials

2. Backup tools ≠ Storage

Backup tools are not PUCE Storage competitors — they are complementary. They are different stack layers.

Fundamental distinction

Backup tools decide WHAT, WHEN and WHERE to back up. PUCE Storage is the WHERE — it receives data over S3 and stores it encrypted, with immutable versions. They work together, not against each other.

Backup tool

Veeam Kasten / aws-cli

Decides: what, when, where

PUCE Storage

Stores encrypted

S3 API + immutable versions

Veeam Kasten

Kubernetes backup

Proven

Backup and restore of Kubernetes applications, with an S3 target.

Status:Immutable backup and restore against the gateway with SHA-256 identical to the original (01/10/2026).

aws-cli

Command-line S3 client

Proven

Reference client for the S3 API.

Status:Proven against the gateway in production.

Industry S3 test suite

Compatibility measure

Proven

The S3 compatibility test suite the industry uses.

Status:218 tests pass and are re-run before every release. Left out on purpose: bucket configuration, CopyObject, POST forms, SSE-C/SSE-KMS and object tags.

Other S3 tools

E.g. rclone, restic, Veeam Backup & Replication, Commvault, NetBackup, NetWorker, RMAN

Not tested

Any tool with a generic S3 target uses the same protocol.

Status:We have not tested them, so we do not claim they are validated. Test on a trial bucket before deciding.

3. S3 compatibility and limits

What passes the industry S3 compatibility test suite, and what is left out, on purpose or because it does not exist today.

Exists and is proven

218 tests of the industry S3 compatibility test suite pass and are re-run before every release.
Up to 5 GiB per request (PUT or multipart part); encrypted multipart supported.
SSE-S3 is accepted.
Versions and Object Lock always on; per-object retention supported.

Not available today

Bucket configuration (versioning, policies, ACLs, lifecycle): the bucket is shared and versions are always on. Buckets are created and deleted in the reseller portal.
CopyObject: copying is a download followed by a new upload.
POST forms and object tags.
SSE-C and SSE-KMS: rejected with a clear error.
Compression and deduplication: S3 access keeps the data encrypted exactly as it arrives. PUCE compression exists in the PUCE Engine and PUCE Video products, not in Storage.
Cross-region replication and cost tiers (hot/warm/cold): not available today.

4. How it compares

The points of comparison are object storage systems — not backup tools. We describe them in generic terms; for the exact capabilities of each, see the provider’s documentation.

Capability	PUCE Storage	Object storage in general
Access	S3 API (path-style, SigV4) at s3.posquantum.com; the reseller provisions the customer and issues the credentials	S3 API or the provider’s own API
Encryption at rest	The gateway encrypts every object (AES-256-GCM, 64 KiB blocks) before storing it, using the service key	Provider-side encryption at rest, depending on the service
Post-quantum sealing on the client	Portal route: ML-KEM-768 in the browser, per-customer key managed by the service, unsealed file rejected (up to 100 MiB per file)	Depends on the provider
Immutability	Versions and Object Lock always on; per-object retention; deleting a version gives the quota back	Depends on the service and configuration
Metering and ceiling	Measured TB-month (bytes stored); per-customer ceiling defined by the product acquired, with a clear refusal	Varies by provider
Location	Primary storage in the EU (Helsinki)	Varies by provider and region

MinIO

Open-source object storage

Software with an S3 API, installed and operated by the customer.

AWS S3

Public-cloud object storage

Public-cloud service and the reference for the S3 API.

Azure Blob Storage

Public-cloud object storage

Public-cloud service with its own API (not native S3).

Google Cloud Storage

Public-cloud object storage

Public-cloud service with its own API.

Wasabi

Cost-oriented cloud object storage

Cloud service with an S3-compatible API.

Backblaze B2

Cost-oriented cloud object storage

Cloud service with an S3-compatible API.

NetApp StorageGRID

Enterprise object storage

Enterprise software with an S3 API, installed at the customer site.

Scality RING

Enterprise object storage

Enterprise software with an S3 API, installed at the customer site.

5. Practical Use Cases

Where PUCE Storage fits today, with what is proven and what is not.

Immutable Kubernetes backup with Veeam Kasten

Challenge

Kubernetes application backups must live outside the cluster and cannot be altered once written.

With PUCE Storage

Kasten writes to PUCE Storage as an S3 target. Versions and Object Lock are always on and the gateway encrypts everything before storing.

Result

Proven on 01/10/2026: immutable backup and restore with SHA-256 identical to the original.

Archive with per-object retention

Challenge

Documents that must be kept unchanged for a period, under the customer’s own protection and retention requirements.

With PUCE Storage

Versions and Object Lock always on, retention set per object and encryption applied by the gateway before storing. Deleting a version gives the quota back.

Result

Encryption and immutability help the customer meet their requirements. PUCE Storage holds no certifications; compliance is assessed in the customer’s own operation.

Reseller with storage customers

Challenge

The reseller needs to give its customers S3 storage, with metered consumption and clear limits.

With PUCE Storage

The reseller provisions the customer, issues the access credentials and creates the buckets in its portal. Billing is per measured TB-month, with a per-customer ceiling defined by the product acquired.

Result

The customer uses the credentials with their own S3 software; on reaching the ceiling, they see a clear refusal.

Files sealed in the browser, with a per-customer key

Challenge

Some files must not leave the customer’s browser without protection under a key specific to that customer.

With PUCE Storage

On the portal route, the file is sealed in the browser with ML-KEM-768 before it leaves. A file that arrives unsealed is rejected.

Result

Per-customer key (managed by the service), with a ceiling of 100 MiB per file on this route. Larger files use S3 access, where the key belongs to the service.

Want to see if it fits your case?

Share your scenario — volume and current backup tool — and we will tell you plainly what PUCE Storage covers today.

Request demo View PUCE Storage