Uncompromising
Infrastructure Security
Enterprise-grade protection with a security-first mindset. Engineered for trust and compliance across all global regions.
Identity & Access
Granular access management with support for MFA, SAML, and OIDC. Limit permissions to asset level.
Anycast Network
Built on a private anycast network with 100+ edge nodes. Content is delivered via shortest path.
Compliance & Audit
Complete audit trail for all data access. Data residency controls to pin assets to specific regions.
Dual-Key Authentication
API Integration
Every request to the Buzstorage edge network must be authenticated using a standard Dual-Key pair. This provides an additional layer of cryptographic isolation between your Access ID and your Secret Key.
// Format: Bearer <AccessKeyId>:<SecretAccessKey>
const ACCESS_KEY_ID = 'ak_prod_...'; // Always include the full prefix
const SECRET_KEY = 'sk_prod_...'; // Always include the full prefix
await axios.get('/api/protected/vaults', {
headers: {
'Authorization': `Bearer ${ACCESS_KEY_ID}:${SECRET_KEY}`
}
});Enterprise Security
We periodically rotate internal root keys and enforce TLS 1.3 for all traffic. For high-security environments, IP Network Security can be strictly enforced on a per-app basis via the Console Settings, rejecting any traffic from unauthorized sources.
Critical Security Requirement
Enterprise CSRF Protection
Double CSRF Pattern
We implement the Synchronizer Token Pattern using double-signed HMAC tokens. Every non-idempotent request (POST, PUT, DELETE) must include a valid x-csrf-token header.
Session Integration
Token Handshake
Clients must first retrieve a cryptographic shell from our public security endpoint before performing state-changing operations.
// 1. Fetch the CSRF token from the public endpoint
const { data } = await axios.get('/api/public/csrf-token');
const csrfToken = data.xcsrftoken;
// 2. Pass the token in the x-csrf-token header for POST/PUT/DELETE
await axios.post('/api/upload', formData, {
headers: { 'x-csrf-token': csrfToken }
});Encryption & Infrastructure
All sensitive file metadata and private URLs are encrypted using AES-256-CBC with secure, rotating initialization vectors (IVs).
All production traffic is secured via TLS 1.3 enforced at both the Nginx Proxy Manager layer (ssl_protocols TLSv1.3) and the Node.js server (minVersion constraint). HTTP/3 is advertised and served via Cloudflare's QUIC layer.
Atomic file persistence and hashed directory isolation ensure cross-tenant zero-leakage and prevent archival corruption.
Mandatory network locking that restricts API access strictly to authorized IPs. Prevents usage of leaked credentials from unknown sources.
Granular Scopes
Allows listing vaults and viewing granular file metadata without download rights.
Grants full write, move, and deletion rights within specified organizational units.
Required for renewing short-lived session tokens in high-security workflows.
Root administrative access including billing, IAM, and infrastructure policy.
Public & Private Visibility
File & Folder Visibility Flags
Every file and folder in Buzstorage carries a visibility flag that is either public or private. This flag is enforced at the infrastructure layer — not just at the application layer — meaning it cannot be bypassed regardless of how a request is formed.
When a folder's visibility is set, all files within it inherit the same flag by default, allowing you to control access for entire directory trees with a single API call.
Public Access
Files are accessible via a permanent, shareable CDN URL with no authentication required. Ideal for static assets, marketing media, and open content that needs global delivery.
Private Access
Files are fully gated. Access via the public content endpoints returns 403 Forbidden (stream) or 404 Not Found (metadata) unless the requester is the authenticated owner. Private files are served exclusively through the authenticated /protected/content/:fileId endpoint using your full API credentials.
// Upload a file and mark it as publicly accessible
const formData = new FormData();
formData.append('file', fileBlob);
formData.append('visibility', 'public'); // CDN URL returned immediately
const { data } = await axios.post('/public/v1/upload', formData, {
headers: {
'Authorization': `Bearer ${ACCESS_KEY_ID}:${SECRET_KEY}`,
'x-csrf-token': csrfToken,
}
});
// data.url → permanent, shareable CDN link
console.log(data.url);