Sustainability
We are building something meant to last, with no venture capital. That means making choices about what we build and how we build it. We answer to the people who use it.
Learn more about why we built this →
Move steady,
build wisely.
We are building storage meant to last: one product, done well.
Where the road leads: your buckets keep serving even when entire cities go dark.
Simplicity
One product, one block, one price. If getting started takes longer than five minutes, the product gets fixed.
Security
Designed in and published, including what it does not protect against. What we claim is what you can audit.
Sovereignty
Hosted and operated entirely in Canada, priced in CAD, built so you can leave with everything.
Does the technology hold, and does anyone want it?
- Eight months of closed alpha on one node, about thirty testers using it for real backups, sites and media.
- montreal-1 specified, then built to that spec: twelve interchangeable drives, ZFS, Garage, and a guard in front.
- Answered: it holds, and people pay for it. The first paying customers are Phase 1's first tick.
That thing is object storage. This sounds like one thing, but it goes very deep.
Polish Storm Buckets from what customers tell us, keep it secure, send the Garage fixes we need upstream, and open two more cities on Garage 3.
The geo-distributed plan
Two durability classes, you pick the tradeoff. What do I risk with a Standard endpoint? Click to jump to the answer. Standard buys the price: one city, one node, and it stays. Redundant buys the redundancy: three cities, three times the price.
Standard · today $9 CAD / TB / month, one cityredundant-1: one block, three cities
Garage's strength is replication. Three Storm nodes in three Canadian cities hold the same block. One city goes dark, the other two keep serving and rebuild the third when it returns. What do I benefit from a Redundant endpoint? Click to jump to the answer.
A target until it is sold. Your block is stored three times, once per city, so it is priced as three. Why will redundant storage be more expensive? Click to jump to the answer.
Redundant · target
$27
CAD / TB / month, 3 nodes × $9
- 1 First paying customers on montreal-1 Done
- 2 A second city serves Standard blocks Ahead
- 3 A third city serves Standard blocks Ahead
- 4 redundant-1: one block replicated across all three Ahead
- 5 A Redundant block serves customers Ahead
- 6 The Gate: 90 straight days without an incident What is "The Gate"? Click to jump to the answer. Ahead
The Gate. What is "The Gate"? Click to jump to the answer. Phase 1 ends when redundant-1 is serving customers and the status page shows 90 straight days without an incident on it: a full quarter, long enough for every node to take its own kernel reboots while the other two keep serving. Nothing about Phase 2 is decided, scheduled or built before that.
Giving back to open source
We run Garage, so the fixes we need go upstream, in the open, for everyone who runs it. Why so much transparency? Aren't you worried about other people copying your model? Click to jump to the answer.
- !1450 CORS preflight for local-alias buckets answers with Access-Control-Allow-Headers Merged 2026-05-12, shipped in v2.4.0
- !1469 Bulk DeleteObjects reports a missing key as deleted, as AWS does Merged 2026-06-17, shipped in v2.4.0
- !1492 UTF-8 file names in browser (PostObject) uploads Merged 2026-07-20, shipped in v2.4.0
- !1599 Presigned PUT accepts the checksums AWS SDKs sign by default Merged 2026-11-07, in the next release
S3 parity
What S3 has, what Buckets has, and where the gap is being closed.
| Feature | State | Where it stands |
|---|---|---|
| S3 API: buckets, objects, multipart uploads | Have | Garage speaks S3. The AWS CLI, rclone, boto3 and Terraform work unchanged. |
| Presigned URLs | Have | Signed GET and PUT links, including the checksums AWS SDKs now sign by default. |
| Static website hosting | Have | Any bucket serves as a site (Storm Sites). |
| CORS, per bucket | Have | A local alias cannot be resolved at preflight, so the rules are enforced on the signed request by the Storm Buckets Guard |
| Local bucket aliases | Have | A Garage feature: your bucket name is yours, nobody fights over it. |
| Advanced key scoping | Our job | A key covers the whole bucket today. Narrower scopes are next, a key held to one prefix for one, enforced on the signed request by the Storm Buckets Guard |
| Object versioning | Upstream | Deuxfleurs is building it clean-slate, by the core team, after closing a 3,000-line contribution they could not maintain. garage#166 |
| Object lock | Upstream | Needs versioning first, and a CRDT store cannot refuse one of two concurrent writes, so upstream has not shipped it. Buckets makes no immutability claim until Garage does. garage!1336 |
| Anonymous reads on the S3 endpoint | Upstream | Public objects serve through the website endpoint today (Storm Sites). Anonymous access on the S3 API itself is an open upstream design question with a draft in review. garage#263 |
| Presigned PUT with SDK default checksums | Upstream | AWS SDKs now sign a checksum by default and Garage refused the upload. Our fix is merged. garage!1599 |
Garage 3
The next major line. The maintainers opened a 3.0 milestone on their tracker in January 2026, no date set. On it today, of what touches Buckets:
- #263 Anonymous reads on the S3 endpoint Open, draft in review (!1306)
- #1266 Bucket and object tags Open
Two pieces of this year's funded work change how a node stores data, and read to us as the groundwork a major version is cut for:
- A new metadata engine LMDB is fragile to machine crashes. SQLite, Fjall and RocksDB are the candidates; the pick is open. If LMDB is fragile to machine crashes, how are you handling that? Click to jump to the answer.
- Backpressure that respects the quorum An upload waits today when one slow node could be left behind. Metadata gets backpressure for the first time.
Not on the list yet: object versioning and object lock, the two rows our parity table waits on. The maintainers are rebuilding both themselves. A change to how objects are stored is major-version work, and v2.5.0 already needed a one-way upgrade, so we expect them in the 3.x line, not in a v2 release. That is our reading, not their promise.
Three things we already run every day and could run well for you. Which one should come first?
Your vote is advisory. It tells us what people want before we build anything, and a count is not an offer. One vote per account, change it any time.
Sign in to vote →
6 accounts voted
Frequently asked
The Gate is a challenge we commit ourselves to completing before we can mark a phase as complete. It must be passed in full before we even start thinking about the next phase or product.
For Phase 1: a Redundant block serves customers for 90 days without an incident.
Phase 2 will have a similar structure, and likely a more difficult gate. This keeps us ambitious while remaining realistic.
Why don't you offer managed Fediverse hosting?
A really good Canadian Fediverse host already exists: Fedihost. That problem is solved, so we do not need to solve it.
When will toronto-1 or vancouver-1 be available?
There are no set dates. Each node arrives when the capital and the time are there to set it up properly. We are bootstrapped, with no venture capital, so count on a few years rather than months.
Can you provision and operate a private server just for my organization?
Yes. That is Storm Consulting: a private Garage cluster we host for you in a Canadian data centre, or Garage on your own machines, with the procedures your team can run without us.
Why will redundant storage be more expensive?
Because it is three times the hardware. A Redundant block is stored once in each of three cities, on three Storm nodes, so it is priced as three blocks: $27 against $9. Standard stays on sale at the same price. It is one city and one node, and we will keep saying plainly what that trades away, so you can choose by what the data needs.
What do I risk with a Standard endpoint?
The data centre goes down. A power or internet outage, or another extreme event at the building, takes the endpoint offline until it is back. Your data lives in one city, so keep an independent copy of anything you cannot afford to lose.
Maintenance reboots. About once every three weeks, an update needs a reboot and the endpoint is down for 15 to 30 minutes, at a quiet hour. We aim to email you 72 hours ahead. A critical security fix goes in as soon as it is ready, at any hour, and in extreme cases, without notice. Security comes first, always.
You do not risk a failed drive. We account for that in the architecture.
What do I benefit from a Redundant endpoint?
Your storage stays up. An outage or an extreme event in one city does not take it offline: the other two cities keep serving. A critical fix can go in at any hour without downtime, because we update one node at a time while the other two serve. Even if a machine or a whole data centre is destroyed, we set up a new node and it rebuilds from the other two. This is storage meant to last.
Will a Redundant block with all three cities in Quebec be available?
Yes, this is something we plan for, though it is far away. We haven't looked into the feasibility or economics of this yet, so it may be more expensive than the usual offerings. For now, Standard montreal-1 keeps your data in Montreal.
If LMDB is fragile to machine crashes, how are you handling that?
A machine crash is an extreme event, but we account for it. We take automated snapshots of the metadata and sync every metadata write to disk. This safety net gives up a bit of write speed and internal storage space, especially for many small objects. The new metadata engine Garage's maintainers are working on is meant to fix this at the source.
Why so much transparency? Aren't you worried about other people copying your model?
No. If anyone wants to copy our model and plan, even using the exact same technologies, we see that as a win. That verifies that the system works, and it leads to a better ecosystem, since more engineering hours and eyes will be on the same open source tools we all rely on. We would rather see five small or mid-sized providers than one hyperscaler. We don't want to become a hyperscaler. Please, copy our model!
Hardening Garage for production
Getting Garage running is an afternoon. Running it so one bad day stays small is the part almost nobody writes about. Every hardening control, ranked S to F from live production, failures kept in.
Read the dispatch →
Migrating from MinIO to Garage: A Complete Guide
MinIO's community edition is archived. This is the actual migration to Garage: the rclone commands, the credential and region gotchas that look like deeper problems, and what silently doesn't come across.
Read the dispatch →Does this sound interesting to you?
Want to support it? Request space and use the service.
We don't take investments or donations, only customers.
Business operations. We plan to incorporate federally in Q1 2027 and aim to partner with a Canadian payment provider the same quarter, so invoices can pay themselves with the methods you already use. Until then, invoices are paid by Interac e-Transfer.