Security & privacy

Customer object data is not persistently stored by BucketPilot. What we keep is metadata — an index of object names, sizes, and storage classes.

Browser transfers use direct presigned URLs: uploads and downloads go straight between your browser and your own storage, and those bytes never pass through BucketPilot's servers.

During a migration or backup you have configured, BucketPilot may temporarily stream object data between the source and the destination you named, without persisting the object contents. That job is the only path on which our infrastructure handles object data at all.

• •The recommended one-click CloudFormation role means no long-lived keys are stored at all: BucketPilot assumes a least-privilege IAM role in your account using a unique ExternalId, and you revoke access at any time by deleting the stack.
• •Where keys are used (access keys, R2 tokens, GCS interop keys, SSH private keys), they're encrypted at rest with AES-256-GCM and never returned by any API after saving.
• •Keys pasted with more permissions than needed are flagged at save time (an admin-level AWS key gets a warning and a suggestion to swap it for a least-privilege one).
• •SSH host keys are pinned on first connect; a changed key stops jobs with both fingerprints shown instead of silently trusting a possibly-impersonated server.

Every resource — credentials, buckets, jobs, activity — is scoped to exactly one workspace (your personal account, or one organization). Nothing is shared across workspaces, and organization roles (admin / member / read-only) gate what each person can change.

Every meaningful action lands in the activity feed — who did what, when, to which bucket or job — including denied permission attempts. On Business, the full feed exports as CSV for compliance reviews.

All traffic is TLS in transit; the app enforces HSTS. BucketPilot runs on AWS. The API surface is minimal by design — the public REST API is read-mostly (its only mutations are running existing jobs, triggering indexing, and issuing presigned downloads), and API keys are stored as hashes and rate-limited per key.

Questions this page doesn't answer — data-processing terms, compliance attestations, or a security review for your procurement process — reach the team at any time via the in-app support assistant or the contact email; you'll get an engineer, not a form.

On the Business plan, the dashboard's activity feed exports as CSV — timestamp, actor, action, bucket, and job for every event in the workspace. Export CSV offers quick ranges (last 24 hours, 7 days, 30 days, all time) or a custom calendar range; the file is named with the dates it covers. Useful for compliance reviews and answering "who did what, when".