Skip to main content

​
The situation

A regulated or multinational business must keep certain data in a given region or cloud, under its own keys, while the rest of the business runs on a global platform. Today that means separate buckets, separate pipelines and a compliance review per application.

​
What OneBucket changes

The rule is written once, at the layer, per bucket. A sovereign bucket is mapped to EU backends under your keys; the global bucket goes wherever policy says. Replication adds copies where they are required. Applications and agents still use one endpoint, and backend keys stay with you. One global application writes through OneBucket; placement policy sends eu-customers to an EU region under customer keys and global-data to a US region, with an on-prem replica

​
How it works

  • Per-bucket placement. A policy maps a OneBucket to its backends and its replication targets. Placement is set per bucket, not per object: objects are not routed individually by prefix or tag.
  • Keys stay with you. Each backend is registered with its own credentials, held in the secure vault. Customer-managed keys remain customer-managed.
  • Proof of location. The locate tool returns where any object physically lives, which is what an auditor wants to see.
  • Regions. OneBucket runs clusters in multiple regions. Global hostnames route each request to the nearest cluster; pin a cluster when requests must land in one place.