Storebridge

Nobody chooses multi-provider storage. It accumulates. A legacy app writes to S3, the data team lands a lake on GCS, an acquired .NET service writes block blobs to Azure, and somebody moved the media library to R2 because egress was free there. Six months later no one can say which bucket holds what, who still has keys to it, or which line on which bill it belongs to.

The tooling does not help, because every provider ships a console that is excellent at its own storage and blind to everyone else's. The CLIs are per-vendor. rclone is genuinely great and also a command line, which means the only people who can move a bucket are the three engineers who remember the flags. Storebridge is the layer above all of it: browse, upload, move, sync, and migrate from one place, with an audit trail switched on from the first connection.

01 Which providers does Storebridge support?

Storebridge speaks the three API families that cover nearly all object storage in production — the S3 REST API, the Google Cloud Storage XML and JSON APIs, and the Azure Blob Storage REST API — plus the long tail of endpoints that claim S3 and speak it with an accent. Adding a provider means adding credentials, not changing how you work.

Azure is the one that breaks assumptions

Azure does not have buckets and objects; it has containers and blobs, and blobs come in three kinds — block, append, and page — with different rules. There is no CreateMultipartUpload. You stage data with Put Block and commit it with Put Block List, against a limit of 50,000 committed blocks per blob. Any tool that models storage as "S3 plus adapters" hits that wall on day one, so Storebridge models the operation (upload a large file, list a prefix, copy across accounts) and lets each driver decide how to perform it.

02 Is "S3-compatible" really compatible?

Mostly, until you push it. Every S3-compatible endpoint handles GET, PUT, DELETE, and a bucket listing; compatibility frays at multipart upload, conditional writes, checksums, and listing semantics — which is exactly the territory a migration tool lives in. "S3-compatible" is a marketing claim until you have run a multipart upload, killed it halfway, and asked the endpoint to list the orphaned parts.

Four places it breaks, in the order we expect to hit them:

• Multipart limits. Amazon allows parts of 5 MiB to 5 GiB, up to 10,000 parts, for a maximum object of 48.8 TiB (AWS docs, checked July 2026). Compatible endpoints do not all enforce the same ceilings, and some reject part sizes the SDK considers legal.
• The multipart ETag is not a checksum. For a multipart object the ETag is an MD5 of the concatenated part MD5s with a dash and the part count appended. It depends on how you chunked the file, so comparing ETags between a source and a destination that chunked differently proves nothing.
• Conditional writes. S3 added If-None-Match and If-Match on PutObject and CompleteMultipartUpload in 2024 and extended conditional behaviour to copy operations in 2025. Plenty of compatible endpoints implement neither, so "do not overwrite if it exists" is not a guarantee you can assume.
• Feature gaps that are not errors. Cloudflare R2 implements the core object and multipart surface but does not implement versioning, object tagging, ACLs, or bucket policies, and restricts which checksum algorithms can be full-object rather than composite (Cloudflare docs, checked July 2026). A tool that assumes versioning exists will silently do the wrong thing rather than fail.

So Storebridge probes on connect. Adding an endpoint runs a capability check — multipart round trip, conditional write, list with a delimiter, checksum support — and stores the result as the connection's profile. Every later job plans against that profile instead of against a hopeful default.

03 How does one app hold four credential formats safely?

Encrypted at rest, scoped as narrowly as the provider allows, read-only unless a job needs otherwise, and never echoed back to the browser. That last one matters more than it sounds: a storage manager is a credential vault whether or not it admits it, and the failure mode is not a bug, it is a breach.

The formats have genuinely different risk shapes. An IAM access key pair can be scoped by policy to one bucket and one prefix. A GCS service-account JSON file carries a private key inside an envelope, and it is the single worst artefact in the set to hold carelessly. An Azure shared key is account-wide with no scoping at all, which is why we prefer a SAS token with an expiry or an Entra ID identity. R2 API tokens can be issued per bucket with read-only permission, which makes them the easiest to do right.

Storebridge encrypts every credential at rest, decrypts it only inside the worker that makes the call, and shows a fingerprint rather than the value once it is saved. Connections carry an explicit mode — read-only, read-write, or migrate — and the UI refuses operations the mode does not cover. Every action lands in an audit trail: who, which connection, which object, which IP, and what the provider returned. That is the same posture we bring to client work in platform and AI integration, where credentials for half a dozen third-party systems end up living in one application.

04 How do you move a bucket without downtime?

In three passes: a bulk copy while the source stays live and serving, a delta pass that catches everything written during the copy, then a cutover where the application switches its writes and a final short delta runs behind it. Anything simpler is a maintenance window with extra steps.

The bulk copy runs as queued workers with per-connection concurrency, because a job that hammers a slow destination at the same rate as a fast one just collects timeouts. Large objects go through multipart or resumable uploads with part-level retry, and progress is written to a manifest so a failure resumes at the part rather than restarting the object. Rate limiting is per connection too — when one destination starts returning 503s, that connection backs off and the rest of the job keeps moving.

Verification, because ETags lie

Storebridge hashes the stream as it passes through and records that hash alongside source size, destination size, and content type. Where the destination supports a full-object checksum we set it, so a later re-check does not depend on chunk boundaries matching. Metadata is copied deliberately, not incidentally: content type, cache control, content encoding, and user metadata all travel, because a migration that drops Content-Type breaks a website quietly.

What sync has to mean when both sides can change

It has to mean one direction. Bidirectional sync without a coordination layer is a conflict generator, so Storebridge syncs one way and asks you to choose the collision policy up front: newer wins, source always wins, or quarantine the conflict for a human. Delete propagation is off by default, because a sync that propagates deletes is a sync that can empty a bucket from a bad prefix filter. Turning it on requires a dry run that lists exactly what would go.

05 What does running more than one provider actually save?

Egress, usually — it is the only line where the gap between providers is an order of magnitude rather than a percentage. Storage per GB varies by maybe five times across the market; the cost of serving a terabyte varies between "nothing" and a real invoice.

The hyperscalers bill outbound transfer per GB. AWS gives 100 GB per month free across services and then charges tiered rates starting around $0.09/GB in us-east-1; Azure and Google Cloud bill outbound transfer on similar per-GB models. Cloudflare R2 charges no egress fee at all and prices operations instead, split into Class A writes and Class B reads. Backblaze B2 gives free egress up to three times your average monthly stored data, then charges per GB. Wasabi and Hetzner both bundle egress into a flat price within a stated fair-use ratio or allowance. (Provider pricing pages, checked July 2026 — rates move, which is why Storebridge reads your actual usage rather than trusting a table we hard-coded.)

The useful question is never "which provider is cheapest per GB". It is "where is the traffic". A 2 TB bucket serving 40 TB a month is an egress problem and belongs somewhere egress is free. A 400 TB archive read twice a year is a storage-class problem and belongs in cold tiers wherever it already lives. Storebridge puts usage and spend per bucket on one screen so that question has an answer before anyone starts a migration.

06 What do lifecycle rules and storage classes really cost?

Every provider offers hot, cool, and archive tiers, and every one of them charges you for leaving early. A lifecycle rule that looks like a saving becomes a bill the moment an object is deleted, rewritten, or promoted inside its minimum duration.

Azure is the sharpest edge here: an archived blob cannot be read in place at all. You rehydrate it to an online tier first, which can take up to 15 hours, and the early-deletion charge is prorated against the 180 days you promised. Storebridge shows an object's tier before you queue a download, warns when a bulk operation would trip a minimum duration, and lets you write one lifecycle policy that it translates into each provider's own rule format.

Signed URLs get the same treatment. S3 presigned URLs, GCS signed URLs, and Azure SAS tokens all do the same job with different mechanics, so Storebridge issues them from one control with a TTL and records who issued what. It is also honest about the limits: a presigned S3 URL cannot be revoked without rotating the key or changing the policy behind it, and the UI says so rather than offering a revoke button that does nothing.

07 Storebridge is in build — come and break it

Storebridge is in active development and there is no self-serve sign-up. We are onboarding a small group of design partners against real buckets and real migrations, because the interesting bugs in this category do not appear on test data — they appear on the bucket with 40 million objects, the prefix nobody documented, and the endpoint that returns a 200 with an empty listing.

Design partners get direct input on the provider order, the migration defaults, and what the audit trail records. In return we want the awkward cases: the Azure account nobody can find the owner of, the S3 bucket with a lifecycle rule from 2019, the "S3-compatible" appliance in a rack somewhere. We build it the way we build everything else — a queued Laravel application with drivers per provider, described in our SaaS product engineering practice — and it sits alongside Mailflow and the rest of our apps as work we run ourselves rather than only ship for clients.

If you are running more than two storage providers and cannot say what any of them cost, tell us about your setup and join the waitlist. We will come back with a walkthrough against your own buckets, not a canned demo dataset.