How to Use AIOZ Storage Effectively: A Practical Checklist

AIOZ Storage best practices come down to seven setup decisions: client config, encryption, credential scope, passphrase backup, overwrite protection, balance and account limits. Most take minutes on day one and hours to fix once data is flowing, so this checklist puts them in the order you meet them.

TL;DR:

• Get the client config right first: endpoint, placeholder region, path-style addressing and "when required" checksums. It's the most common setup failure.
• Know what default server-side encryption covers, then scope credentials and back up your bucket passphrase on purpose.
• Plan for two gaps up front: there's no documented object versioning, and an unpaid balance leads to deletion after 3 days.

Updated Nov 4, 2026: rechecked every item against AIOZ's docs and the live endpoint, turned items 3, 6 and 7 into the questions people ask, added a checklist diagram, a glossary link and one list of what the docs don't cover. The Oct 19 update (no installable end-to-end gateway, checksum settings for the CLI) still stands.

1. Configure the Client Correctly the First Time

Every AIOZ Storage integration needs four settings. You point the client at the custom endpoint, https://s3.aiozstorage.network, and give it the placeholder region us-east-1, which SDK constructors require even though AIOZ Storage isn't split into regions. You also turn on path-style addressing and set upload checksums to "when required".

Path style has a different name in each tool. Set forcePathStyle: true in JavaScript, addressing_style: path in boto3's Config, or addressing_style = path under s3 in ~/.aws/config for the AWS CLI. For boto3 uploads, the full setting is Config(request_checksum_calculation="when_required", response_checksum_validation="when_required", s3={"addressing_style": "path"}). For the CLI, set AWS_REQUEST_CHECKSUM_CALCULATION=when_required or request_checksum_calculation = when_required in ~/.aws/config.

Current AWS SDKs and the CLI send chunked uploads by default, and the endpoint rejects those with MissingContentLength. Bucket subdomains don't resolve either, so a virtual-hosted-style request fails before it reaches a bucket. We first saw both on Oct 19, 2026, and reproduced them with the JavaScript SDK on Nov 4. The JavaScript, Go, Python and CLI quickstarts walk you through the rest of the setup.

2. Know What Default Encryption Covers

AIOZ Storage encrypts every object server-side by default, and you don't have to set anything up. Our servers encrypt data as it arrives and decrypt it when they serve it back, so your plaintext passes through AIOZ's infrastructure on each request.

The docs also describe end-to-end encryption through a self-hosted gateway, but you can't install that gateway yet. Its GitHub repo still holds only a README that says the CLI and tutorials "will be available soon", with no release to download (rechecked Nov 4, 2026). The docs' CLI page uses the AWS CLI against the hosted endpoint, so it takes the same server-side path.

If a file must never reach any provider in plaintext, encrypt it on your own machine before you upload it and keep that key outside AIOZ. Either way, AIOZ doesn't store your bucket passphrase, which is item 4.

3. Should You Use a Member, an Access Grant or a Presigned URL?

Pick by how long the access needs to last, because AIOZ Storage gives you three tools and each fits a different job:

• A member is for a teammate who needs standing access. Give them Read, Write, List or Delete on exactly the buckets they need, not All on everything.
• An access grant is for a script, an integration or a contractor with a known end date. When you create one, you pick an end date of 24 hours, 1 week, 1 month, 6 months or 1 year, so it can't live forever by accident.
• A presigned URL is for a single download or upload. It leaves no standing credential at all.

This is the principle of least privilege that NIST's glossary defines, and the same one AWS's IAM best practices push for. Grant only the access a task needs, for only as long as it needs it, instead of sharing one master credential.

4. Back Up Your Bucket Passphrase Before You Need It

AIOZ doesn't have or store your bucket's encryption passphrase. That keeps your data private, and it cuts both ways: if you lose the passphrase with no backup, the bucket's contents are gone for good. No support ticket can recover them, so download the passphrase or write it down the moment you create a bucket.

5. Plan for Overwrites Without Object Versioning

AIOZ's docs list no object versioning feature, so you can't count on getting back an older copy of an object after it's overwritten. If a pipeline or a person can overwrite a key in place, plan for that now. Put a version in the key itself, such as dataset/v3/file.csv instead of always writing dataset/file.csv. Or use a tool built for the job, like DVC, which adds versioning on top of any S3-compatible remote, including AIOZ Storage.

This matters most for files you'd hate to lose: model checkpoints, configuration files and anything without a second copy elsewhere. If you want the background, our explainer on how S3 object versioning works covers what the feature does on other platforms.

6. What Happens If Your Pre-Paid Balance Runs Low?

Your account locks, and three days later your data can be deleted. AIOZ Storage has no free plan and no invoice-then-pay model: you deposit funds first, and usage is metered every hour against that balance. The minimum balance equals your storage bill from the previous charging cycle, so a $100 bill last cycle means a $100 minimum now (penalty policy).

Drop below that minimum and the account locks, which means no uploads and no downloads, though your data stays in place. If you don't settle the balance within 3 days, AIOZ Storage deletes all data on the account automatically. Set an alert on your balance well before it gets close, so you don't find out from a locked account in the middle of a pipeline run.

7. What Are AIOZ Storage's Account Limits?

Three hard limits apply to every account: 100 buckets, 100 sub-users and 100 requests per second (usage limits). Build backoff and retry logic into high-throughput workloads, rather than assuming every burst of concurrent requests will succeed. If your design is likely to approach any of these numbers, plan how you split buckets and sub-users from the start, so you don't have to restructure under pressure.

How AIOZ Storage Handles These Defaults

Most of this list is about choices AIOZ Storage leaves to you, while two defaults are already in place: server-side encryption on every object and AIOZ never holding your passphrase. Everything else, from the client config to the balance alert, is yours to set up before real data arrives.

What the docs don't cover yet:

• The checksum and path-style settings in item 1. The docs' samples set path style but not the checksum options.
• What happens to a request past the 100 per second rate limit.
• An installable end-to-end encryption gateway, as covered in item 2.

Next step: open AIOZ's Upload Your First Object guide and work through items 1 to 4 as you create your first bucket.

Frequently Asked Questions

What's the most common AIOZ Storage setup mistake?
Forgetting path-style addressing (forcePathStyle or addressing_style: path), because bucket subdomains don't resolve and requests fail before they reach a bucket. A close second is the upload checksum default in current AWS SDKs and the CLI, which makes uploads fail with MissingContentLength unless you set it to "when required".

Can I use end-to-end encryption with AIOZ Storage?
Not today. Server-side encryption is the default and the mode that works now. If you need client-side encryption, encrypt files yourself before you upload them.

What happens if I lose my bucket passphrase?
The bucket's contents can't be decrypted again. AIOZ doesn't store your passphrase, so there's no recovery path, and you should back it up the moment you create a bucket.

Should I create a member or generate an access grant for a new integration?
Create a member for a teammate with standing access and their own login. Generate an access grant for a script, a contractor or an integration with a known end date, since it expires on its own.

Does AIOZ Storage support undoing an accidental overwrite?
Not through a documented versioning feature. Put a version in the object key itself, or use a tool like DVC that adds versioning on top of any S3-compatible remote.

How much warning do I get before AIOZ Storage deletes data for an unpaid balance?
You get 3 days after the account locks for a low balance. Your data stays in place during the lock, and deletion happens only if the balance is still unsettled after that window.

What are AIOZ Storage's hard account limits?
Each account gets 100 buckets, 100 sub-users and a rate limit of 100 requests per second, per AIOZ's usage-limit docs.

Related Reading

• What Is AIOZ Storage? S3-Compatible Decentralized Storage: the full product model this checklist assumes throughout.
• How AIOZ Storage Encryption Works, From Passphrase to Key: the key derivation chain behind items 2 and 4.
• AIOZ Storage Access Control: Macaroons and Access Grants: the credential model behind item 3.
• Managing Team Access and Sub-Users on AIOZ Storage: the step-by-step wizard for creating scoped member accounts.
• SI data pipelines on AIOZ Storage: the versioning gap and DVC workaround behind item 5.
• 3-2-1 Backup Rule Explained, and Why 3-2-1-1-0 Exists: the wider backup framework that item 5 fits into.
• Managing AIOZ Storage Buckets with Terraform, Step by Step: the account limits from item 7 applied to infrastructure as code.
• Static Website Hosting on AIOZ Storage: Full Setup Guide: the passphrase care from item 4, applied to a bucket that is also a public website.
• How Automatic MIME Type Detection Works on AIOZ Storage: an upload-time behavior to know about alongside these setup decisions.
• What Is S3 WORM Storage? Object Lock Modes and Setup: the industry feature behind the overwrite gap in item 5.
• What Is S3 Object Versioning and How Does It Work?: the versioning mechanism itself, which item 5's workaround stands in for.
• What is an MCP server, and how do SI agents access storage?: the same client-config details from item 1, applied to an agent's tool server.
• How to Rename a File in an S3 Bucket on AIOZ Storage: the dashboard's rename, move and delete actions, and which ones aren't supported.
• Object Storage Glossary of S3, Security and Backup Terms: definitions for every term in this checklist.

References

• AIOZ Storage Documentation: Usage Limits
• AIOZ Storage Documentation: Penalty Policy
• AIOZ Storage Documentation: Billing
• AIOZ Storage Documentation: Manage Access Grants
• AIOZ Storage Documentation: Upload Your First Object
• NIST CSRC Glossary: Least Privilege
• AWS IAM: Security Best Practices