The bucket holds ciphertext; the key sits on your box

Your customer's security questionnaire has a row for encryption at rest, then a follow-up row: who holds the key. The bucket provider's own encryption answers the first row and fails the second.

Connect the Paris bucket as an S3 backend with its endpoint, then wrap it: POST /api/v1/backends/crypt with the bucket as the remote and a passphrase. hoody-files encrypts contents and filenames before they reach the bucket and decrypts on read. The passphrase lives in the container's backend manifest on your own server, sealed, never returned by the API.

The bucket provider stores ciphertext with ciphertext names. Reading the files means reaching the running files service on your box, which is exactly what proxy permissions gate.

Two rows, two different answers. The data sits in Paris, and the key sits with you.

The data sits in Paris, and the key sits with you.