DRAFT — not approved for public service use
Version: 2026-09-18.6
Effective: 2026-09-18

# Free Service Description and Security Responsibilities

This is the service schedule for **Free S3**. It forms part of the [Terms](/legal/terms). It describes the free plan, not an uptime-guaranteed SLA or an independent security certification.

## 1. Included service

| Item | Free plan |
| --- | --- |
| Price | £0; no automatic paid conversion or overage billing. |
| Storage | 10,000,000,000 bytes / 10 decimal GB per account. |
| Bucket allowance | One opaque, randomly named bucket; private by default with an optional portal-managed public read-only mode. |
| Credentials | Up to 2 active keys, allowing a rotation overlap. |
| Download allowance | 50 decimal GB per UTC calendar month; metering and response as explained below. |
| Interface | S3-compatible API at the endpoint shown in the dashboard. |
| Portal | Registration, verification, account/credential/visibility management, usage/status views and a basic object browser. |
| Support | Email to support@backends.co.uk; no guaranteed response or resolution time. |

S3 clients transfer objects directly to the published storage endpoint. The portal manages accounts, credentials and service settings rather than receiving customer object uploads and downloads. The operator may use a gateway or reverse proxy in front of that endpoint; relevant providers appear in the [Provider Register](/legal/subprocessors).

The object browser signs direct S3 requests in the customer's browser using an existing scoped access key and secret. The secret remains in page memory for that tab and is not submitted to the portal backend or saved in browser storage by this feature. Single browser uploads are limited to 64 MiB and downloads to 128 MiB; larger and multipart transfers require a separate S3 client.

## 2. Quotas and usage information

Storage usage is periodically measured, not counted synchronously as a financial billing meter. A quota can be exceeded temporarily before further writes are rejected. Large or simultaneous writes and multipart operations can increase this effect. Usage may include storage not obvious from a simple client listing.

The configured mode monitors transfer and does not automatically suspend an account for crossing the measured allowance. We may contact you or take proportionate manual action under the fair-use terms. The dashboard identifies unavailable or stale information where possible. There is no promise of exact real-time metering, automatic object-count enforcement, a particular maximum request rate, or unlimited traffic. We respond to excess resource use under the Terms and Acceptable Use Policy, without undisclosed overage charges.

## 3. Availability and data durability

We will operate with reasonable care and skill. Nevertheless, there is no numerical uptime commitment, service-credit scheme, guaranteed restoration point or restoration time on the free plan. Maintenance, software faults, equipment failures, connectivity problems, security incidents and external dependencies can interrupt service.

The service is not a substitute for your own independent backup. No customer object-backup, version-history, undelete or point-in-time-restore service is included. Infrastructure snapshots or replication, where configured, do not by themselves create a customer recovery guarantee. We do not claim a specific storage durability percentage or geographical redundancy.

Nothing here waives our data protection security obligations or liability which cannot lawfully be excluded. We assess and test the recovery measures appropriate to the information we handle. If your workload needs stronger guarantees, do not rely on the free tier without a separate agreement.

## 4. Security responsibilities

Our responsibilities include controlling operator access, maintaining confidentiality obligations, applying bucket-specific authorisation, separating customer and administrative interfaces, protecting temporary portal-held secrets and operating incident handling. We require TLS on public production endpoints and restrict the administration path to authorised systems/operators. Our operational safeguards must remain appropriate to the actual deployment.

Your responsibilities include protecting passwords, email accounts, access keys, devices and applications; choosing safe content and object names; maintaining independent copies; selecting appropriate client-side encryption; and promptly reporting compromise. Use the minimum access you need and remove keys no longer in use.

Private buckets are not an end-to-end or zero-knowledge encryption service. The operator and infrastructure providers with authorised access may technically be able to read stored material. Public mode deliberately allows anonymous retrieval of an exact object URL, without anonymous listing or modification. No storage-at-rest encryption algorithm, certification, malware-detection guarantee or geographic restriction is promised beyond the explicitly verified deployment details.

## 5. Credential lifecycle

Secrets are shown once following password confirmation and are temporarily encrypted while awaiting reveal. An unrevealed secret expires after 24 hours. A secret supplied for a connection test is processed temporarily for that test. Stored authentication material in the storage service is separate from the portal's one-time reveal copy.

Background creation, testing, rotation, suspension and revocation are asynchronous. Check the confirmed operation status before relying on a restriction. During rotation, the old key continues to work until revoked. A request that fails or remains queued has not necessarily changed active S3 access.

## 6. Features outside the plan

Customer-defined bucket policies, anonymous listing/writes, unrestricted public CDN hosting, custom domains, paid billing, contractual high availability, hard object-count caps, exact bandwidth cut-offs and managed backups are not included. The basic object browser does not provide multipart upload, bulk operations, version history, malware scanning or an undelete facility. A pre-signed URL generated by an S3 application can still give its holder access to the authorised object; private bucket configuration does not prevent that sharing mechanism.

Operational deletion and account-closure requests use an operator-managed case, opened from the authenticated portal or through support. The case manager tracks assignment, reviewed holds, tasks and deadlines but does not itself delete objects, buckets, IAM identities or accounts. Our [Return and Deletion Policy](/legal/data-return-deletion) explains the process and timing.

## 7. Incident and vulnerability reporting

Report a security issue to security@backends.co.uk, abuse to abuse@backends.co.uk, and an availability issue to support@backends.co.uk. Do not include secrets or unnecessary personal data. Security reporting does not grant permission to access another account, exploit a vulnerability or interrupt production. We can agree a safe scope for further investigation where appropriate.

Where we become aware of a personal-data breach involving data we process for a customer, we notify the customer without undue delay under the Data Processing Agreement. A free support plan does not postpone that duty until a convenient support window.