Skip to main content

Encryption

Fil One encrypts all data by default. There is nothing to configure — encryption is always on.

Encryption at rest​

All objects stored in Fil One are encrypted at rest. Encryption is applied automatically when data is written and decrypted automatically when data is read. You do not need to set any headers or configure any options, and it cannot be disabled.

Encryption is performed by the S3 storage gateway for the region your bucket lives in, not by the Fil One console. This applies to all objects in all buckets, with no exceptions.

Do not send encryption headers. Fil One applies its own server-side encryption, and you cannot request a specific mode. Uploads specifying ServerSideEncryption: aws:kms (SSE-KMS) are rejected in both regions: with InvalidRequest in us-east-1, and with AccessDenied or InvalidRequest in eu-west-1 depending on the operation (PutObject, CopyObject, and CreateMultipartUpload are all affected). SSE-C headers are rejected in eu-west-1 too. Omit the header entirely, encryption is applied either way.

In eu-west-1, the bucket-level encryption operations (GetBucketEncryption, PutBucketEncryption, DeleteBucketEncryption) also return AccessDenied, so there is no encryption configuration to read or change there. Encryption is still always on.

Encryption in transit​

All connections to the regional endpoints (https://eu-west-1.s3.fil.one, https://us-east-1.s3.fil.one) use TLS. HTTP connections are rejected. Your data is always encrypted during transmission between your application and the Fil One endpoint.

This applies to all API operations, including uploads, downloads, presigned URLs, and metadata requests.

Key management​

Encryption keys are held by the regional storage operator that fulfils storage for your bucket's region, not by Fil One and not by you. You do not supply or manage encryption keys, and there is no customer-managed-key option.

If your compliance requirements depend on the specific cipher in use, or on who holds key material for a given region, contact support — those details are set by the regional operator rather than by Fil One.

Client-side encryption​

If your security requirements call for client-side encryption (encrypting data before it reaches the network), encrypt the bytes in your own application before uploading. Note that AWS's dedicated S3 Encryption Client exists only for some SDKs (Java, .NET, Go, Ruby) — boto3, the AWS CLI, and the JavaScript SDK v3 do not provide one — so with Python, the CLI, or JavaScript you must handle encryption yourself with a standard crypto library. Fil One stores whatever bytes you send: if you encrypt client-side, the stored object is the encrypted blob.

Client-side encryption is optional and is in addition to the server-side encryption that Fil One applies automatically.