Built so security teams sign off.

Encrypted in your browser with a public key before they are sent to us, so we only ever store the ciphertext: AES-256-GCM with the data key wrapped using RSA-OAEP (SHA-256). They are decrypted in memory only to run the operation you asked for, then discarded. They never come back to the browser, never appear in an API response, and never enter a log. Self-hosted, you hold the private key.

No. Uploads pass through our API as a stream — the bytes go from your browser into your bucket in 25 MB parts, in memory, and are never written to disk or kept once the upload finishes; streaming them this way is what lets uploads work without any CORS or bucket configuration. Downloads and previews go straight from your bucket to your browser over 15-minute presigned URLs and never touch us. Rename and copy move object bytes only between two keys in your own bucket, server-side, on any provider — they never pass through anywhere else. Everything else the API does moves no object data: listing, metadata, signing download links, deletion, and supported bucket/folder creation. There is no object cache, no object database, and no object storage on our side.

Per-person IAM users are permanent artifacts: keys to rotate, console access to manage, off-boarding to remember. S3 Viewer members aren't IAM users — they sign in to S3 Viewer, and their role is checked on our server before any request is signed with the server's single credential. Removing them cuts access immediately; no AWS keys to cycle, no policies to update, nothing for an attacker to lift from a stale config.

Yes. The repo is open source under the MIT license. Self-host it behind your VPN or inside your VPC and credentials, sessions, and traffic never leave your network. The RSA key pair used to encrypt credentials is yours to generate and manage.

Remove them in the members dialog. They lose access to that server on their next request. You don't have to rotate any AWS or R2 keys — they never held any. Other teammates and applications keep working.

A least-privilege policy scoped to the buckets you want to expose, typically with s3:GetObject, s3:PutObject, s3:DeleteObject, and s3:ListBucket. For listing inside a specific prefix only, add a Condition on s3:prefix. The IAM-permissions how-to has a full example policy.

Yes. S3 Viewer is MIT-licensed and the source is on GitHub. Audit the encryption code, the request signing path, and the access checks for yourself. Fork it, contribute, or self-host without paying anyone.