S3-Compatible Object Storage

What is S3 storage? Object vs. block vs. file storage

S3-compatible storage is a storage model in which data is kept not in a folder hierarchy but as objects inside containers called buckets, each with a unique key and its own metadata. Access happens through API calls over HTTPS rather than file shares or mounted disks. This design makes it easy to grow to very large volumes and very high file counts without losing performance.

Because every object carries its own metadata, searching and classifying archives with millions of files becomes much easier. Web applications can write user uploads, images and documents straight to buckets, so there is no need to keep expanding the application server’s disk. Backup software can use S3-compatible storage both as the primary backup repository and as the target for a secondary copy.

Object storage is not a good fit for frequently changing database files; its strength is data that is written once and read many times, or retained for long periods.

Service assurance: Support requests for S3-compatible storage are handled by the priority levels in the service level agreement; for critical situations where access is fully down, the first-response target is 15 minutes. Stored data is protected under an ISO/IEC 27001 certified information security management system (see our certifications).

Common mistakes when using object storage as a backup repository

• Planning to enable Object Lock later: in most configurations, immutability is defined when the bucket is created; adding it afterwards may require a new bucket and reconfiguration.
• Using a single access key everywhere: backup software, applications and administrators should each have separate access keys scoped to the least privilege they need.
• Setting retention independently of the backup policy: the Object Lock period must align with the retention rules in the backup software; otherwise capacity fills up faster than expected.
• Not testing restores: having a backup in a bucket does not mean it can be restored; run restore tests regularly.
• Relying on a single copy: object storage should be positioned as one of the copies in the 3-2-1 rule.

How immutable backups work against ransomware is explained in our what is immutable backup guide; setting up and monitoring the backup policy can be handled as part of our Backup Management service.

Criteria that define the scope of S3-compatible storage

Object storage requirements are not measured by today’s data volume alone; how data will be written and read, and how long it will be retained, also shape the scope. Planning answers the following questions:

• Initial volume and growth rate: the amount of data to be migrated initially and the monthly growth trend.
• Retention and versioning: how many versions to keep and when older versions are deleted; capacity grows faster in buckets with versioning enabled.
• Object Lock period: which data requires immutable retention, and for how many days.
• Access profile: whether data is read frequently or is largely archival.
• Connection method: encrypted access over the internet, or a VPN or private connection.
• User and key management: how many applications and teams will access the storage with separate permissions.

Prices exclude VAT. The final price depends on capacity, data traffic, object lock (immutable) needs and retention period and is set in the quote. Data stays in the Equinix Istanbul data center, inside Turkey. The capacity needed for camera recordings can be estimated with the CCTV storage calculator.

With properly defined lifecycle rules, expired objects are cleaned up automatically and capacity stays under control in line with your data policy.

Data location: your S3 data stays in Turkey

In MAV Cloud S3 Object Storage, buckets and the objects in them are kept in the Equinix data center in Istanbul; data is not transferred abroad. With global cloud providers, a bucket’s location depends on the region chosen when it is created, and most of those regions are outside Turkey. Picking the wrong region can mean backups containing personal data leave the country without anyone noticing.

When backups and application data include customer, employee or patient information, the cross-border transfer rules of KVKK, Turkey’s Personal Data Protection Law (Law No. 6698, Article 9), apply: a transfer must rely on an adequacy decision, appropriate safeguards such as standard contracts, or one of a limited set of exceptions. Keeping data in Turkey at the infrastructure level means no cross-border transfer for storage; access or copying from abroad still has to be assessed separately. Other obligations such as privacy notices, retention periods and security measures still apply.

A Turkish location also gives backup traffic from servers and offices in Istanbul a shorter network path than a region abroad. For your other servers, see server hosting in Turkey; for security camera footage, we also offer CCTV Cloud.