Who downloads what, from where, how big, how often — that record is now worth more than the data itself. Every cloud keeps yours. XNS has no access to your data or your metadata, and no coordinator ever watches your reads.
Content tells you what one file holds. Metadata tells you everything else — and it doesn't need to be decrypted to do it.
How we compare
Encrypting file names isn’t the same as hiding who pulls what, when. A coordinator in the read path sees the pattern regardless of how the bytes are scrambled.
*Storj encrypts file names, but bucket names are plaintext and its own privacy policy logs access frequency, shard sizes, IP and times. "Zero-knowledge" covers content — not access patterns. · verify before publish · 2026-06XNS AWS S3 Wasabi Backblaze Storj Sees your object names No Yes Yes Yes Encrypted* Sees access patterns (who · when · size) No Yes Yes Yes Yes Coordinator in the read path None Yes Yes Yes Satellite Can hand over your activity Can't — we don't hold it Yes Yes Yes Yes
The Relayer — your S3 gateway — runs on-prem or with your MSP and holds the only copy of your object index. It never ships to XNS.
Each object is encrypted on your side, then erasure-split into 120 slivers across independent providers — one of 120, unreadable, uncorrelatable. A provider can't tell a backup from a video, or your file from anyone else's.
To contract storage and bill you, it maps a cost-center ID to the sectors you hold — your exact contracted capacity and where those sectors sit, because that's the invoice. And nothing more: no object names, no per-access events, no read history. Nothing close to a satellite watching every request.
Downloads go from your gateway straight to the providers. There is no coordinator in the read path to log who pulled what, when. This is the line Storj can't cross — its Satellite brokers every single access.
The whole list
Bucket names, object keys, sizes, folder structure, versions, tags and access times live in the database on the gateway you run. They are never sent to us. What does leave is the operational telemetry needed to meter usage and watch the health of the network. This is all of it — not a summary, not the highlights.
There is a second way to check this, blunter than any policy statement: the XNS-side service that handles our contracting and settlement — the only system that ever talks to your Relayer about money — contains zero occurrences of the word “bucket”. It has no concept of one. A system cannot report what it has no field for.
Under central contracting we can suspend a contract on a lawful order. We can't surrender what we don't hold — your data and your activity aren't ours to give. So the demand lands where it belongs: on you, the owner.
In 1979 the Supreme Court ruled that anything you hand a third party loses its Fourth-Amendment protection. The cloud turned that ruling into a business model. XNS gives it back.
Storj is locked to central satellites. We run both — and even our convenient default never sees your data or metadata.
We broker the storage pools so you never touch crypto or wallets. The only thing we record is your invoice — a cost-center ID mapped to contracted capacity. Never your object names, your contents, or your reads. The most any legal order can compel is ending a contract, never handing over your bytes.
Your Relayer contracts directly with the network using its own wallet. No central party at all — not even a contract for anyone to terminate. Pure self-custody of your storage. Storj can't decentralize; you can.
Get keys, point any S3 tool at your Relayer, and store on a network that holds your storage — and nothing about you.