What does it cost to restore a backup from XNS?

Nothing. Egress is $0 with no ratio cap, no overage price and no separate retrieval fee, under the terms current at xns.tech/pricing.json. A full restore costs the same as leaving the data in place, which is what makes monthly restore drills practical.

How is my backup data protected against a stolen credential?

Compliance-mode Object Lock stops deletion at the storage layer: once a retention period is set, no credential can shorten or lift it until it expires. Legal hold adds an indefinite freeze on top, and versioning with delete markers makes overwrites recoverable.

Is my backup data encrypted on XNS?

Yes, unconditionally. Every shard is XChaCha20-encrypted before it leaves the gateway, with no setting to enable and nothing to forget, then erasure-coded 80 data and 40 parity across up to 120 independent hosts. No single host holds a reconstructable object.

Which backup tools work with XNS?

restic, kopia, the AWS CLI, boto3 and the MinIO mc client are confirmed working against the gateway. rclone and other SigV4 S3 tooling use the same signing path. Point the tool at your own Relayer endpoint and the standard S3 settings apply.

← Backup & disaster recovery Backup workflow · capabilities and limits

Immutable backups, and a restore that costs nothing

Q: Does XNS support immutable backups with S3 Object Lock?

Yes, in both governance and compliance modes, plus legal hold. A compliance-mode retention period cannot be shortened or lifted by any credential until it expires, including the account owner's and including ours.

Immutable, versioned, restorable backups on storage you run yourself — compliance-mode Object Lock, legal hold, lifecycle expiration and a restore that costs nothing however big it is. Below: exactly which parts of the S3 API a backup workflow uses, and how each one behaves here.

Write-once retention nothing can shorten Restores are free, at any size restic · kopia · rclone · AWS CLI

The short version

A backup you cannot afford to restore is not a backup

Two things decide whether an offsite copy is really protection. Can something delete it — ransomware, a stolen key, a bad script, an angry ex-admin? And can you afford to pull all of it back on the worst day of the year?

XNS answers both the same way for every customer. Compliance-mode Object Lock means a retention period cannot be shortened or lifted by any credential until it expires — not a stolen key, not your own owner credential, not ours. And egress is $0, uncapped, so a full restore costs the same as leaving the data sitting there: nothing. Testing your DR plan monthly costs nothing either, which is the only reason anyone actually does it.

The rest of this page is the detail behind that: every part of the S3 API a backup tool touches, what it does here, and where our model differs from the big clouds’.

Present and tested

Everything an immutable backup workflow needs

Every row is published test by test on the S3 compatibility matrix. Last verified 5 September 2026.
Capability	Status	What it gives your backups
Object Lock — compliance mode	Supported	Write-once retention no credential can shorten, including the account owner’s. This is the ransomware control.
Object Lock — governance mode	Supported	Retention an explicitly privileged principal can override, for the cases where you need an escape hatch.
Legal hold	Supported	Indefinite hold independent of the retention clock, for litigation and audit.
Bucket versioning + delete markers	Supported	Overwrite and delete are recoverable events rather than terminal ones.
Lifecycle expiration	Supported	Retention policy enforced by the store, with a real execution sweep — not config that is only read back.
Noncurrent-version expiration	Supported	Old versions age out on their own schedule, so versioning does not become an unbounded bill.
Multipart upload, range GET, conditional requests	Supported	Large backup sets upload resumably and restore in parallel chunks.
Server-side CopyObject	Supported	Copies between buckets without pulling bytes back through your network.
Maximum object size	No cap	No 5 TB ceiling of the kind AWS, Ceph, MinIO and Wasabi apply.
IAM users, groups, roles, STS	Supported	A backup job gets its own scoped key rather than your owner credential.
Public Access Block, bucket policies	Supported	Buckets are private by default; public read requires an explicitly enabled policy.
Encryption at rest	Always on	Every shard XChaCha20-encrypted before it leaves the gateway, then erasure-split 80 data + 40 parity across up to 120 independent hosts. No setting to forget.
Audit log	Supported	Every S3 request recorded — who did what to which object, allowed or denied, with status.
Tested backup clients	Verified	restic, kopia, the AWS CLI, boto3 and MinIO `mc` confirmed working. rclone and other SigV4 tooling expected to work on the same path.

How the model differs

Four places XNS works differently from a big cloud

If you are moving a backup job across, these are the settings that behave differently — each one because the architecture underneath is different, not because a box is unticked.

One tier, so there is nothing to tier into

The big clouds sell four or five storage classes and lifecycle rules to shuffle data between them, because cold storage is how they make a large archive affordable. XNS has one class at one rate, with no retrieval fee and no egress charge — the cold-storage price without the cold-storage penalty. There is nothing colder to move into, and nothing to get wrong.

What to change in your tool: point it at STANDARD and drop any storage-class transition rules. Expiration rules work normally, including noncurrent-version expiration.

Geographic distribution instead of bucket replication

Replication exists because a big cloud keeps your data in one region and needs a copy in another. XNS never puts it in one place to begin with: every object is erasure-coded into 80 data and 40 parity shards across up to 120 independent hosts, in a geography you compose. Losing a host, a facility, or an entire operator is the case the repair process is built for.

What to change in your tool: nothing to configure. If your policy requires a second copy held by a different vendor entirely — sound practice with any single provider, us included — drive two remotes from your backup tool. restic, kopia and rclone all do this natively, and a tool-driven copy is verified on write and restorable without our involvement.

Encryption you cannot forget to turn on

On most platforms encryption at rest is a header, a bucket setting, or a key-management service you wire up — and a misconfiguration is silent. Here every shard is XChaCha20-encrypted before it leaves the gateway, on every upload, with nothing to enable. No single host ever holds a reconstructable object.

What to change in your tool: nothing. Client-side encryption in restic, kopia, Duplicati, Duplicacy or Arq layers on top exactly as you would expect, and we never see the key.

Deletion is stopped by retention, not by a second factor

The threat is the same everywhere: a credential falls into the wrong hands and the backups go first. Compliance-mode Object Lock answers it at the storage layer — a retention period cannot be shortened or lifted by any credential until it expires, including the account owner’s and including ours. Add legal hold when you need an indefinite freeze on top.

What to change in your tool: set retention at the bucket or object level as you would on any S3 target. Governance mode is available where you need a documented override path instead.

Before you move production data

Three things worth checking first

Your compliance obligations, in their own words. If a framework or an auditor names a specific mechanism — a particular key-management service, a named audit report — check the wording before you evaluate rather than after. Ask us where we stand on anything your obligations name; we would rather answer it up front.
The gateway is yours to run. You operate the Relayer on your own Docker host at a domain you control, which is what makes the storage private and the endpoint yours. It also means keeping it patched and reachable is your job, not a vendor’s.
Run a restore before you rely on it. Not because we expect a problem — because a backup nobody has restored is a claim, not a control. It costs nothing here, so there is no reason not to.

Every capability above is published test by test on the S3 compatibility matrix, against AWS S3, Ceph, MinIO, Wasabi, Backblaze B2 and Storj. If you want the evidence rather than the summary, start there.

Test your DR plan for real.

Every capability above is published test by test on the compatibility matrix, head to head with AWS S3, Ceph, MinIO, Wasabi, Backblaze B2 and Storj. Read the evidence, not the summary.

Read the compatibility matrix

Backup and disaster recovery on XNS

Explore the platform

The full platform

Everything you need to go from evaluation to production.

How it works →The Relayer, erasure coding, and your Virtual Private Datacenter.S3 compatibility →Head-to-head S3 feature matrix vs the field.Eleven nines →Durability, computed — not rounded up.What's new →Everything built since you last looked.Releases →Every build, newest first — what changed and when.

Claims on this page last verified September 7, 2026