SECURITY AND ACCESS CONTROL
The right data. For the right people.The right data. For the right people.
Keep customer storage separate and let applications control who can read, change or find their data.
Separate customers. Shared peace of mind.
Private buckets · Separate credentials · Enforced permissions
One customer’s credentials are not another customer’s access.
Each provisioned service gets its own storage identity and credentials. Include a first private bucket in your product setup, or let customers create one from their service panel. Customers access the storage you provision for them—not somebody else’s files.
Customer A
Unique service credentials and private buckets created for this customer. Access is limited to the resources authorised for this identity.
Customer B
A separate storage identity and credentials, with its own private buckets. Customer A’s credentials do not grant access to this service.
Customer A
Unique service credentials and private buckets created for this customer. Access is limited to the resources authorised for this identity.
Customer B
A separate storage identity and credentials, with its own private buckets. Customer A’s credentials do not grant access to this service.
Customer A
Unique service credentials and private buckets created for this customer. Access is limited to the resources authorised for this identity.
Customer B
A separate storage identity and credentials, with its own private buckets. Customer A’s credentials do not grant access to this service.
Stop scattering permission checks through your application.
Keldra’s Zanzibar-inspired model links people, groups and resources. Express group permissions, roles and per-record access, then enforce those rules at the data layer for reads, writes and queries. System realms cover platform resources; custom realms describe your application’s own relationships.
1
Alice belongs to Editors
Give people access through their relationships, rather than copying permission lists into every application screen.
2
Editors may update project files
A role or group grants the operations its members need on the appropriate resources.
3
The rule follows the resource
A permitted project record can be read or updated. A financial record outside that permission remains inaccessible.
Search only what the user can access.
Query indexed records with the requesting user’s permissions applied. Applications do not need to fetch another customer’s results and hide them afterward.
{ "id": "order-1042", "customer": "customer-a" }
{ "id": "order-1043", "customer": "customer-a" }
A query authorised for Customer A can return these records. Customer B’s records are excluded by the access policy.
A straightforward split of responsibilities.
You keep the customer relationship. Keldra enforces the access rules configured for the storage.
You manage the customer relationship
Create services in WHMCS, set your own products and prices, and handle customer support and billing.
Keldra enforces configured access
Separate storage identities, private buckets and permission enforcement for reads, writes and queries.
Customers keep credentials private
Each service has its own credentials. Keep them in the application’s secret configuration, not public code or shared screenshots.
You manage the customer relationship
Create services in WHMCS, set your own products and prices, and handle customer support and billing.
Keldra enforces configured access
Separate storage identities, private buckets and permission enforcement for reads, writes and queries.
Customers keep credentials private
Each service has its own credentials. Keep them in the application’s secret configuration, not public code or shared screenshots.
You manage the customer relationship
Create services in WHMCS, set your own products and prices, and handle customer support and billing.
Keldra enforces configured access
Separate storage identities, private buckets and permission enforcement for reads, writes and queries.
Customers keep credentials private
Each service has its own credentials. Keep them in the application’s secret configuration, not public code or shared screenshots.
Get started with access control.
Start with a private bucket, then build the permission model your application needs.
Start with a private bucket
Create or open a private bucket from a provisioned customer service, then use its credentials to upload and retrieve your first file.
Understand relationship-based access
See how groups, roles, inherited permissions and custom realms fit together.
Start with a private bucket
Create or open a private bucket from a provisioned customer service, then use its credentials to upload and retrieve your first file.
Understand relationship-based access
See how groups, roles, inherited permissions and custom realms fit together.
Start with a private bucket
Create or open a private bucket from a provisioned customer service, then use its credentials to upload and retrieve your first file.
Understand relationship-based access
See how groups, roles, inherited permissions and custom realms fit together.
Common questions about permissions
Private storage for every service, with finer-grained rules when your application needs them.
What permission model does Keldra use?
A Zanzibar-inspired relationship model connects people, groups and resources. It can represent group permissions, roles, per-record access and inherited relationships, with enforcement for reads, writes and queries.
Can customers use standard S3 clients?
Yes. Customers can use S3-compatible clients and SDKs with their service credentials and regional endpoint. Configured permissions still determine which resources they can access.
What permission model does Keldra use?
A Zanzibar-inspired relationship model connects people, groups and resources. It can represent group permissions, roles, per-record access and inherited relationships, with enforcement for reads, writes and queries.
Can customers use standard S3 clients?
Yes. Customers can use S3-compatible clients and SDKs with their service credentials and regional endpoint. Configured permissions still determine which resources they can access.
What permission model does Keldra use?
A Zanzibar-inspired relationship model connects people, groups and resources. It can represent group permissions, roles, per-record access and inherited relationships, with enforcement for reads, writes and queries.
Can customers use standard S3 clients?
Yes. Customers can use S3-compatible clients and SDKs with their service credentials and regional endpoint. Configured permissions still determine which resources they can access.