Why a Backblaze-Cheap Object Store Doesn't Make Your Files Private

Object storage and a personal cloud are not the same product

A Backblaze B2 bucket runs $0.006/GB-month — about $6/TB, a little over half what beebeeb charges at €10.99/TB. So the question writes itself: why pay for a consumer cloud when you can rent an S3 bucket for pennies? Because they solve different problems. Object storage hands you a raw, addressable blob store with an API and nothing else. A personal cloud is the sync client, the sharing, the versioning, the file tree your phone understands — and, if it's built right, client-side encryption the operator can't undo. The bucket gives you none of that. You build it, or you live without it.

What you're actually renting from B2, Wasabi, and R2

Object stores are infrastructure primitives. You get a flat namespace of keys mapped to bytes, reachable over an S3-compatible HTTP API, with the operator holding the keys to encryption at rest. Since cost is the whole reason anyone reaches for this, here are the 2026 numbers:

Read the last column twice. Every one of these encrypts your data at rest: the provider scrambles your bytes on their disks with keys they manage, then unscrambles them the moment an authenticated request arrives. That defends against a stolen drive. It defends against nothing else — not the provider, not a subpoena, not a rogue employee, not a compromised control plane. The operator can read your files because the operator holds the key. "Encrypted at rest" is a line on a SOC 2 report, not a privacy guarantee.

Is object storage private?

No, not in the sense most people mean. With B2, Wasabi, R2, or S3, the provider can technically read every byte you upload and will hand it over if legally compelled. Server-side encryption stops disk theft; it does nothing about the company running the disks. To make a bucket genuinely private you have to encrypt every object yourself, before it leaves your machine, with keys the provider never sees. That's the line — and it's a real engineering project, not a config toggle.

The gap between a bucket and a cloud you'd actually use

Say you commit to the project. Turning an S3 bucket into something you'd trust with your photos and your tax returns means building:

• Client-side encryption. Encrypt each file locally before it leaves the device. You need a key-derivation scheme with a real memory cost (something like Argon2id) to protect the password, an authenticated cipher (AES-256-GCM) for the data, per-file or per-chunk keys, and a recovery path for the day you forget your password. Reuse a nonce and you've leaked plaintext relationships to anyone watching the bucket.
• A sync client for every device. Conflict resolution, partial and resumable uploads, a local index that survives a crash. This is the hard, unglamorous core of Dropbox, and it took them years to get right.
• Encrypted sharing. Wrapping a file's key for a recipient's public key (X25519-style), plus link expiry, revocation, and passphrase-gated links. A bucket gives you a presigned URL and a shrug.
• The rest of "cloud storage." Versioning, a folder model, search, thumbnails, mobile apps — everything that makes it feel like a product instead of a key-value API.

People do build this. restic, rclone with crypt, and Cryptomator over a bucket are good tools, and I'd never talk anyone out of them. But once you've assembled the stack you are the operator, the on-call engineer, and the person who has to stay right about cryptography indefinitely. The few euros you save per terabyte buy you a second job.

Where beebeeb sits on this line

beebeeb is the managed version of that project, built so the encryption isn't optional and isn't yours to misconfigure. Files are encrypted on your device with AES-256-GCM before they leave it. Login uses OPAQUE, so your password never reaches our server — its key-stretching runs Argon2id tuned to 256 MiB at sign-in, not on every file. Sharing wraps keys with X25519; recovery derives your master key with the same 256 MiB Argon2id cost from a BIP39 phrase you hold and we never see. We run zero-knowledge encryption on every tier, including the free one — the server stores ciphertext and metadata it can't open. That's the difference between "encrypted" as a storage feature and encrypted as an architecture. With a B2 bucket the provider decrypts to serve you. With beebeeb there is nothing on our side to decrypt with.

On what you actually get today: a web app, a CLI with WebDAV through it, encrypted sharing with expiry, revocation, and passphrase links, file versioning that keeps recent versions with configurable retention, file requests, TOTP two-factor, and passkeys. Native mobile and desktop apps, plus one-click import from Google Drive and Dropbox, are coming soon — not shipped. The shipped clients today are the web app and the CLI. I'd rather you read that here than discover it after signing up. The product clients are open source, so the encryption claims are auditable rather than asserted; the marketing site and server are not. An independent audit is planned, and the findings will be published.

The honest tradeoff is price. At €10.99/TB we cost more than a raw bucket, and we should — you're paying for the encryption layer, the clients, and the sharing to exist and stay maintained, in Falkenstein, Germany, under EU law. If you genuinely just need cheap cold blobs behind your own crypto, a bucket plus restic is a defensible, cheaper choice. If you want a personal cloud that's private by construction and you don't want to become its maintainer, that's the thing we built.

The conflation that started this

"Object storage vs cloud storage" is a question at all because the pricing pages look comparable and the word "encrypted" sits on both. It means opposite things in each place. On a B2 page it means the provider holds your keys. On a zero-knowledge page it means they can't. Shop by per-terabyte cost alone and you're comparing a bare hard drive to a filing system — and quietly handing your keys to whoever runs the disks. For how a key-holding consumer service stacks up in practice, our breakdown of Dropbox walks through exactly what "the provider holds the keys" costs you.

Storage scales up to 99 TB self-serve, with a custom quote beyond that.