Built so security teams sign off.

Encrypted in your browser with a public key before they are sent to us, so we only ever store the ciphertext: AES-256-GCM with the data key wrapped using RSA-OAEP (SHA-256). They are decrypted in memory only to run the operation you asked for, then discarded. They never come back to the browser, never appear in an API response, and never enter a log. Self-hosted, you hold the private key.

We do not persist object contents. Smaller uploads arrive in a single API request; larger uploads use browser-coordinated multipart requests through the API. Both stream bytes into your bucket in memory, without writing object contents to disk or requiring bucket CORS changes. Individual downloads and media previews use 15-minute presigned URLs to load directly from your bucket. The editor, cross-server transfers, and ZIP archive downloads also process object contents through the API in memory. Same-server copies and renames use the storage provider's copy operations. Listing, metadata, signing download links, and deletion do not read object contents. There is no persistent object cache, object database, or object storage on our side.

Per-person IAM users are permanent artifacts: keys to rotate, console access to manage, off-boarding to remember. S3 Viewer members aren't IAM users — they sign in to S3 Viewer, and their role is checked on our server before any request is signed with the server's single credential. Removing them cuts access on their next request, though a download link they already opened keeps working for up to 15 minutes; no AWS keys to cycle, no policies to update, nothing for an attacker to lift from a stale config.

Yes. The repo is open source under the MIT license. Self-host it behind your VPN or inside your VPC and credentials, sessions, and traffic never leave your network. The RSA key pair used to encrypt credentials is yours to generate and manage.

Remove them under Settings, Members. They lose access to that server on their next request; a download link they already opened keeps working for up to 15 minutes. You don't have to rotate any AWS or R2 keys — they never held any. Other teammates and applications keep working.

Owners can switch on a tamper-evident audit log per server; it is off until they do. Every record is hash-chained to the previous one, so Verify integrity detects edited or missing rows. The owner decides who can view it, whether it records everything or only changes and downloads, and how long records are kept — self-hosters set the minimum with AUDIT_RETENTION_MIN_DAYS (90 days by default). It covers actions taken through S3 Viewer; changes made with other keys or the provider's console never appear.

A least-privilege policy scoped to the buckets you want to expose, typically with s3:GetObject, s3:PutObject, s3:DeleteObject, and s3:ListBucket. For listing inside a specific prefix only, add a Condition on s3:prefix. The IAM-permissions how-to has a full example policy.

Yes. S3 Viewer is MIT-licensed and the source is on GitHub. Audit the encryption code, the request signing path, and the access checks for yourself. Fork it, contribute, or self-host without paying anyone.