Platform

Storage you can build a business on

TCN Storage combines durable object storage, access control and data management behind the S3 API you already use, and puts an edge network in front of it.

Storage layer

Objects are split into data and parity fragments and spread across three failure domains in the region. Every fragment carries a checksum that is verified on write, on read and by a continuous background scrubber.

  • 99.999999999% designed annual durability
  • Strong read-after-write consistency
  • Objects up to 5 TiB with multipart upload

Data protection

Versioning keeps every overwrite and delete recoverable. Object lock adds write-once-read-many retention for backups and records that must not change.

  • Governance and compliance retention modes
  • Legal hold per object
  • AES-256 encryption at rest, per-bucket keys

Access control

Access keys are scoped to buckets, prefixes and actions. Bucket policies use the familiar S3 policy grammar, and presigned URLs grant time-limited access without sharing keys.

  • Key expiry and source network conditions
  • SSO with SAML 2.0 and OIDC for the console
  • Audit log of every management action

Data management

Lifecycle rules expire old versions, abort stale multipart uploads and move objects to the infrequent-access class. Replication copies new objects to other regions within seconds.

  • Asynchronous cross-region replication
  • Daily bucket inventory reports in CSV or Parquet
  • Batch operations on millions of objects

Event notifications

Subscribe a webhook to object events and trigger processing the moment data lands. Deliveries are signed, retried with backoff and visible in the console.

  • Created, deleted, restored and replicated events
  • Prefix and suffix filters
  • HMAC-SHA256 signatures on every delivery

Observability

Per-bucket metrics for requests, errors, latency and bytes are available in the console and through the management API. Access logs can be written to a bucket of your choice.

  • One-minute metric resolution, 13 months retention
  • Prometheus-compatible metrics endpoint
  • Access logs in S3 server log format
Policies

Least privilege by default

New access keys have no permissions until you grant them. Bucket policies are evaluated together with key scopes, so a leaked upload key cannot read or delete data.

  • Deny-by-default evaluation
  • Conditions on prefix, IP range, TLS and time
  • Policy simulator in the console
bucket-policy.json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "UploadOnlyToIncoming",
      "Effect": "Allow",
      "Principal": { "TCN": "key:TCNK7Q2M4X9EXAMPLE" },
      "Action": ["s3:PutObject", "s3:AbortMultipartUpload"],
      "Resource": "arn:tcn:s3:::media-assets/incoming/*",
      "Condition": { "Bool": { "tcn:SecureTransport": true } }
    }
  ]
}
Compatibility

S3 API coverage

The operations most applications rely on are fully supported. The complete matrix, including headers and error codes, is in the API reference.

OperationSupport
PutObject, GetObject, HeadObject, DeleteObjectSupported
CopyObject, DeleteObjectsSupported
CreateMultipartUpload, UploadPart, CompleteMultipartUploadSupported
ListObjectsV2, ListObjectVersionsSupported
Get/PutBucketVersioning, Get/PutObjectLockConfigurationSupported
Get/PutBucketLifecycleConfigurationSupported
Get/PutBucketPolicy, Get/PutBucketCorsSupported
Get/PutBucketReplicationSupported
SelectObjectContentnot supported
Bucket ACLsread-only, use policies

Open the API reference

Bring your workload

Our engineers will size a proof of concept with you: data volume, request profile, regions and delivery.