Customer uploads land on metal you rent, not a bucket you lease

Each customer has a container. The upload hits that container's files URL and lands on the bare metal server you rent. No object store, no presigned URL, no storage provider that can list keys or be subpoenaed for them. The filesystem is the storage; the proxy serving the URL runs on the same machine.

Hoody's API records that the container exists. It doesn't see the files. The disk is LUKS-encrypted with the key held elsewhere, so a pulled drive is dark.

Four hundred customers is four hundred containers on one box; idle ones share disk blocks copy-on-write and cost nothing extra.

The upload goes from the customer's browser to your disk, and the list of parties who can read it is you.