a data layer, not another copy
OneBucket™ holds no data itself. it sits in front of object storage across clouds, on-prem and edge, presents it as one logical namespace over s3 and mcp, and decides by policy where data lives, replicates and is served from. the storage underneath is unchanged.
three things, done at one layer
not a storage system, not a warehouse, not another copy.
connect natively
one s3-compatible endpoint and a native mcp server reach every source: aws s3, azure blob, gcs, wasabi, akave, oci, on-prem and edge, with no application changes.
place by policy
a policy maps each bucket to its backends and says how writes land: synchronous, asynchronous or cache, with a write quorum. written once, at the layer, and it holds everywhere.
access anywhere
caching, prefetch and replication make distributed data feel local. objects can be copied, moved or migrated between backends while applications keep reading and writing.
four planes, one control point
the protocol and data planes handle every request. the control and event planes govern and record everything they do.
s3, mcp and azure blob
- s3 and mcp for apps and agents
- s3 and azure blob to your storage
- the only surface clients see
two paths
- synchronous: every read and write
- asynchronous: replication, migration, prefetch
console and policies
- organizations, users, keys
- one policy per bucket: peers, sync, async, cache, quorum
- secure vault for backend credentials
event bus
- every operation is an event, scoped to organization and key
- list, fetch and tail over mcp
- the audit trail, built in
one way in. every store behind it.
clients only ever speak s3 or mcp to OneBucket. it speaks each backend's own protocol behind the endpoint, across regions and providers: one instance, in a public region or in your own data center, presents buckets from all of them as one namespace.
- applications
- ai agents
- analytics
- people
s3 · mcp · azure blob
reads, writes, replication
one policy per bucket
every call, audited
- cloud
- on-prem
- edge
- air-gapped
your apps and agents connect over
OneBucket connects to
one policy per bucket decides every move
where data lives, when it is replicated, cached or migrated, and when it is best left where it is. written once, at the layer.
example: the app writes once. two synchronous peers must confirm before the write succeeds; the third copy lands asynchronously.
how writes land
- synchronous peers
- asynchronous peers
- cache mode, near compute
- a write quorum you set
how data moves
- copy, move or migrate between backends
- prefetch before a job runs
- opportunistic fill as data is read
- no downtime, no application changes
who can do what
- outer limits set per key
- read, write, delete by policy
- drop a key to read-only instantly
- each organization fully isolated
governed by design
central auth, and the keys to your storage never leave you.
backend keys stay in the vault
provider credentials live in a secure vault with their backend. applications and agents never see them; they authenticate to OneBucket only.
no raw cloud keys for ai
agents reach data over mcp with oauth 2.1 and audience-bound tokens, inside limits a policy sets per key.
every call is an event
every operation is recorded, scoped to organization and key, and can be listed, fetched or tailed live over mcp.
manage it your way
everything you set up in the console, you can script. everything that happens, you can stream.
s3 and mcp
any s3 tool, sdk or engine works unchanged. agents use mcp for data and a second mcp server for events.
set it up as code
keys, backends and policies can all be managed through an api, so setup lives in your own scripts and pipelines. full reference on request after sign-up.
feed your own tools
list, fetch or tail every operation, scoped to organization and key, into your audit, monitoring or security tooling.
sign in, see everything
one web console for organizations, users, keys and policies. sign in with google today; microsoft and github are coming.
deploy it where you need it
or don't deploy it at all: as saas, it's live the moment you sign up. one global endpoint routes every request to the nearest live cluster.
saas
already running, nothing to install. global endpoints route each request to the nearest cluster. see the endpoints
your vpc
run OneBucket next to your workloads, in your own cloud account.
on-prem
a container image and a helm chart on kubernetes, up in minutes.
air-gapped
fully disconnected sites, for strict residency and isolation rules.
see it on your own data
sign up and it's live. or pick a scenario and we'll prototype it with your team.
request an account