Every conventional cloud gives you a region dropdown and keeps the architecture for itself. XNS hands you the pieces: which operators hold your data, in which countries, spread how widely, tuned for durability or for distance. This page is the whole model in one read — who owns what, how a write actually travels, and what you run yourself.
The difference in one picture
You sign in to their console, pick the nearest region from a list they wrote, create buckets and upload a whole copy of your data to one building. They replicate it to a second. Most cloud data exists in exactly two places, both operated by the same company, under one jurisdiction's law. They run the endpoint, so they hold the keys, resolve your bucket names and write down every request. You select the storage operators yourself — by geography, by measured durability and availability, by distance, by the country whose law you need. Your object is encrypted on your own gateway, split into 120 fragments, and dispersed across the operators you chose. No operator holds enough of an object to rebuild it, and none of them holds a key. Neither do we.Conventional cloudTheir datacenter, their console
XNSYour datacenter, your endpoint
Your own dashboard, showing the providers currently in your virtual private datacenter and the wider network behind them. Every node on that map is a machine somebody else paid for, powered and connected — which is the reason capacity can appear where a requirement appears.
Who owns what
There is no XNS building. Capacity is contributed by independent operators who are paid to hold shards and are measured continuously on whether they actually do. You contract with the set you selected; XNS handles the settlement between you and them, and never sees what is being stored.
The Relayer runs on your host. It encrypts, erasure-codes, disperses, and keeps the database of bucket names, object keys and access times. You patch it, monitor it, and hold the key material. Nothing about your data is legible without it. Each holds a slice of an object that was already encrypted before it left your building. They are paid per byte held and are replaced automatically when their measured reliability drops. They cannot read what they hold and cannot rebuild it. We match your requirements to available operators, meter what you used and settle the payments. The complete list of what our systems receive is published on the metadata page. It contains no bucket names, no object keys and no access times.YouThe endpoint and the keys
Storage operatorsFragments, and nothing else
XNSContracting and settlement
The composer, as it actually appears. Four dimensions — durability, availability, distance and compliance jurisdiction — and the set of providers that satisfy all of them at once. No other cloud hands you this screen, because with a single owner there would be nothing on it to choose.
How a write actually travels
aws-cli, boto3, rclone, restic, a backup appliance or a VMS bridge — whatever you already run. The only change is the endpoint URL. There is no XNS SDK and no proprietary protocol. Encryption happens before anything leaves the building, using key material derived on your own machine. The bucket name and object key are written to the gateway's local database and go no further. The object becomes 120 fragments: 80 carrying data and 40 carrying parity. Any 80 of the 120 can rebuild the original, which is why the loss of whole operators is survivable rather than fatal. Your provider set was composed by durability, availability, distance and country before a byte was written. The fragments are distributed across it, so no single operator, datacenter or jurisdiction holds a reconstructible copy. Your Relayer collects the fragments it needs, rebuilds the object and decrypts it locally. There is no retrieval fee and no egress meter, so reading your own data as often as you like does not change the bill. The network watches each operator's measured reliability. When an object's calculated loss probability approaches the line, fresh fragments are re-placed on stronger operators before anything is actually lost. The arithmetic is published.1Your application does a normal S3 PUT
2The Relayer encrypts it on your host
3It is erasure-coded 80 + 40
4Fragments go to the operators you selected
5Reads come back the same way, and cost nothing
6Repair runs continuously in the background
Out of the box
Buckets, objects, multipart uploads, versioning, object lock, lifecycle rules and presigned URLs. We publish the conformance suite result operation by operation — including what fails — on the compatibility matrix. IAM users, groups and policies, bucket policies, object and bucket ACLs, public access block, and an audit log of every allowed and denied request — all of it held on your gateway rather than in an XNS account. Build your provider set by durability, availability, distance and compliance jurisdiction. The matching operator count updates as you narrow it, and applying the change re-contracts the network to match. $6.00 per TB per month for what you store. Egress is $0, retrievals are $0, and the erasure-coding parity that protects your data is included rather than billed as extra capacity.An S3 endpoint your tools already speak
Identity and access control
The composer
A flat, all-in rate
Identity and access control, running on your gateway. Users, attached policies, access keys and a live record of what was denied and why — held in your installation’s own database rather than in an account with us.
The durability arithmetic, the conformance results, the list of what our systems receive and the split of what you operate versus what we do are all published. None of them need a call with us first.