Trust boundary

Know which parts are open source.

Maskura has an Apache-2.0 data plane and a separately operated hosted service. You can inspect and run the data path without a Maskura account.

In the public repository

  • The self-hosted S3-compatible gateway and object data plane
  • The Wasm runtime, WIT contracts, built-in filters, and plugin lifecycle
  • The CLI, local MCP server, generated SDKs, and storage adapters
  • Tests, benchmarks, security documentation, and architecture decisions
Inspect the source

In hosted Maskura

  • An operated S3-compatible data plane—no gateway deployment, upgrades, or uptime work
  • Workspace-scoped identity, API keys, and access controls managed from the dashboard
  • Your own cloud bucket or managed storage, without changing the S3 clients you already use
  • Versioned read and write pipelines per bucket, using built-in or custom Wasm plugins
  • Usage, billing, transaction visibility, and pipeline audit history in one place
Try Maskura

Where data flows

With the self-hosted gateway, Maskura’s hosted service is not in the request path. You operate the gateway and choose the destination storage.

With hosted Maskura and your own bucket, object bytes pass through the operated data plane and then go to the workspace’s configured storage. With managed storage, the hosted service also supplies the destination. The selected pipeline decides whether supported fields pass through, are redacted, or are encrypted; unsupported content is not automatically confidential.

Choose who operates it

Use hosted Maskura when you want the gateway, control plane, updates, and operational safeguards run for you. Self-host when you need complete infrastructure control, local-only operation, or custom S3-compatible endpoints. Both use the public data-plane engine; the local Docker quickstart runs without a Maskura account, cloud account, or database.

Run the local quickstart or read the repository’s security policy.