PUCE Storage
S3 object storage, encrypted by the gateway before it is stored, with immutable versions. Provided through your reseller.
Try it — your file, post-quantum encrypted
Real upload with your account: encrypted in the browser (ML-KEM-768) BEFORE it leaves, presigned URL, never through our server.
No objects yet. Upload a file above.
What PUCE Storage does today
Three things that exist in production and are proven.
S3 API access
S3 API (path-style, SigV4) at s3.posquantum.com. The reseller provisions the customer and issues the access credentials; the customer uses them with their S3 software.
Encrypted before storage
The gateway encrypts every object (AES-256-GCM) before storing it. The storage provider only ever sees encrypted data.
Immutable versions
Versions and Object Lock are always on; retention is set per object. Every change creates a new version.
How it works
The path of an object, from the S3 request to metering.
S3 access
The customer connects with the credentials issued by the reseller and uses the S3 API (path-style, SigV4). Up to 5 GiB per request (PUT or multipart part); encrypted multipart is supported. Buckets are created and deleted in the reseller portal.
Gateway encryption
Every object is encrypted in 64 KiB blocks with AES-256-GCM, using the service key, before it reaches storage. In this mode the key belongs to the service, not to the customer.
Portal route: sealing in the browser
In the portal, the file is sealed in the customer’s browser with ML-KEM-768 before it leaves, with a per-customer key managed by the service (isolated between customers, but the service can open it). A file that arrives unsealed is rejected. This route has a ceiling of 100 MiB per file.
Immutable storage in the EU
Versions and Object Lock are always on; retention is per object. Deleting a version gives the quota back. Primary storage is in the EU (Helsinki).
Metering and ceiling
Billing is per measured TB-month (bytes stored), with a per-customer ceiling defined by the product acquired. When the customer reaches it, they see a clear refusal.
Use cases
Four uses, with what is proven and what is not.
S3 target for backups
Veeam Kasten performed an immutable backup and restore against the gateway, with SHA-256 identical to the original (01/10/2026). Other tools with a generic S3 target use the same protocol, but only Kasten and aws-cli are proven by us.
Data with regulatory requirements
Encryption and immutability (versions and Object Lock, per-object retention) help the customer meet their protection and retention requirements. PUCE Storage holds no certifications; the customer’s compliance is assessed in the customer’s own operation.
Applications that speak S3
S3 compatibility was measured with the industry S3 compatibility test suite: 218 tests pass. Some functions are left out on purpose (see “Compatibility and limits”); test your application on a trial bucket before deciding.
Archive with per-object retention
With versions always on, a change never overwrites the previous version. Retention is set per object, and deleting a version gives the quota back.
PUCE Storage vs traditional storage
Six concrete points. The right-hand column describes what tends to vary, not a specific provider.
| Feature | PUCE Storage | Object storage in general |
|---|---|---|
| Access | S3 API (path-style, SigV4) at s3.posquantum.com | S3 API or the provider’s own API |
| Encryption at rest | AES-256-GCM in 64 KiB blocks, applied by the gateway before storing | Provider-side encryption at rest, depending on the service |
| Post-quantum sealing on the client | Portal route: ML-KEM-768 in the browser, per-customer key managed by the service (up to 100 MiB per file) | Depends on the provider |
| Immutability | Versions and Object Lock always on; per-object retention | Depends on the service and configuration |
| Metering and ceiling | Measured TB-month (bytes stored); per-customer ceiling with a clear refusal | Varies by provider |
| Location | Primary storage in the EU (Helsinki) | Varies by provider and region |
Compatibility and limits
What passes the industry S3 compatibility test suite, and what is left out, on purpose or because it does not exist today.