Data processing for your object storage

S4 sits between your application and S3-compatible storage, running a Wasm plugin pipeline on every object in transit. Filter PII, envelope-encrypt fields, mirror across clouds — without changing your storage layer.

Get Started View on GitHub

$ curl -X PUT https://api.s4.231self.com/bucket/data.json \
  -H "Authorization: Bearer s4_xxx:s4s_xxx" \
  -H "x-s4-backend-url: https://s3.amazonaws.com/..." \
  -d @data.json

How it works

Your App

Put objects through S4 instead of directly to S3. Pass a presigned URL for the destination. S4 uses zero of your storage credentials.

Plugin Pipeline

Wasm components run in a sandboxed pipeline: detect PII, envelope-encrypt fields, stable-encrypt for JOINs, or write your own.

Your Storage

Objects land in your bucket — S3, B2, R2, GCS, MinIO. S4 never stores your data. You keep full control of your storage layer.

Built-in plugins

PII Detection

Detect and redact emails, SSNs, credit cards. Modular: enable only what you need.

Envelope Encryption

RSA-OAEP + AES-256-GCM per field. S4 never sees your private key.

Stable Encryption

Deterministic AES-SIV. Same input = same output. Enables JOINs, deduplication.

Cross-Cloud Mirror

Dual-write to multiple S3-compatible backends with consistent hashing and failover.

Pay for what you use

No subscriptions. No base fees. Per-request + per-GB.

See Pricing