Data Protection
Second-level restore
A delete is only a marker. The original object stays and restores with one click.
Ransomware recovery
Encryption is overwrite. Clean versions stay in history, roll back to any point before infection.
Off-site isolation
Backup runs on separate hardware and credentials. Deletes do not propagate, and nobody can erase it.
Deletion or ransomware, the data still comes back
A MinIO-based enterprise data protection solution. Versioning blocks overwrite, Object Lock blocks deletion, and off-site backup isolates the attack surface, so deleted files restore in seconds and encrypted data rolls back to a clean version.
The Problem
Traditional backup cannot save these two cases
The most common data loss is not a failed disk. It is human deletion and ransomware encryption. Real-time high-availability replication faithfully copies deletions and encryption to both sides at once. What you actually need is version protection plus an isolated backup.
Accidental deletion
Staff delete the wrong file or wipe the wrong folder, with no version to fall back on by the time anyone notices.
Wrong overwrite
Saving the wrong content over an important version, with no history to roll back to on ordinary storage.
Ransomware encryption
Ransomware mass-encrypts files. If the backup is overwritten too, the last line of defense falls with it.
Malicious deletion
After a credential leak, an attacker wipes data to hide evidence. Without immutability, it is gone for good.
MinIO vs AWS S3
S3-compatible, but the data stays in your hands
The solution is built on MinIO object storage. It speaks the same standard as AWS S3, so tools and code carry over directly. The difference is where it runs, how it is priced, and who controls it. Only self-hosted on-premises storage meets data-residency and isolation needs.
Same S3 standard
MinIO is compatible with the same API as AWS S3, so existing S3 tools and SDKs in any language work directly. No vendor lock-in, and migration later stays easy.
Data in your hands
AWS S3 keeps data in the cloud; MinIO runs on your own hardware and site, meeting data-residency and compliance needs, and works even offline.
Predictable cost
S3 bills by stored volume, API calls, and egress traffic, and egress in particular adds up; MinIO is a one-time hardware and software cost with no per-access or egress fees.
Full control and isolation
Internal access runs at LAN speed with no round-trip over the internet; the three-zone isolation, network, and credentials all stay under your control, fitting sensitive and air-gapped environments.
Choosing between them: for cloud-native, globally distributed, elastic scaling, AWS S3 fits; for on-premises, data sovereignty, predictable cost, and isolated control, MinIO is the better choice.
Migration
Migrate from AWS S3 to MinIO, painlessly
Because MinIO is compatible with the same S3 standard, switching needs no code rewrite, only new connection settings; existing data moves over with a single mc mirror command, incrementally, verifiably, and reversibly. After the switch you save cloud egress fees and gain deletion and ransomware protection.
STEP 01
Change connection
Point the endpoint from AWS S3 to the MinIO address, swap credentials, enable path-style. Application logic and S3 SDK / CLI stay almost unchanged.
STEP 02
Move the data
Use mc mirror or rclone to diff object-by-object and sync incrementally from S3 to MinIO, moving large datasets in batches with resumable transfers.
STEP 03
Rebuild protection
Turn on versioning, lifecycle, and Object Lock in the console, and onboard the bucket into daily backup and the three-zone architecture.
STEP 04
Verify and cut over
Compare object counts and hashes on both sides, then point the app to MinIO once they match. Keep the old S3 for a while as a fallback.
Capabilities
One solution, six lines of defense
From everyday deletion to major disaster, every loss scenario has a matching recovery path.
Second-level undelete
A delete only adds a marker; the original object stays. The console flags recoverable files directly, and removing the marker restores it. No waiting for tomorrow's backup.
Versioning
Every overwrite keeps the old version, and mistakes roll back to any point in history. Retention by count and by days is adjustable, balancing capacity against recovery depth.
Off-site backup
The backup runs on separate hardware, storage, and credentials. Daily incremental or real-time replication never carries deletion, so whatever is deleted on production stays intact on backup.
Object Lock immutability
The backup enables WORM protection. During retention no one can delete or overwrite a version, not even an administrator, shutting down evidence-wiping and ransomware destruction.
Anomaly detection
Monitoring the daily backup change volume raises an alert on abnormal bulk changes, lighting up the moment data is being mass-encrypted and buying a response window.
Smart tiering
Placement follows real access: idle, larger data moves to a low-cost cold tier, frequently read data moves back to hot, cutting cost without hurting access.
Ransomware Defense
Why encrypted data is still recoverable
Ransomware defense is not about stopping encryption but about guaranteeing recovery. Encryption happens at the application layer and storage cannot block it, but as long as every file has a clean historical version and the backup cannot be altered, data always has a way back.
LAYER 01
Versioning blocks overwrite
Encryption is mass overwrite. With versioning on, the encrypted content is just a new version, and the clean pre-encryption version stays intact in history.
LAYER 02
Object Lock blocks deletion
WORM retention on the backup means even someone holding admin credentials cannot delete a version, so an attacker cannot delete history first and then encrypt.
LAYER 03
Backup isolation
The backup has separate credentials and network, allows only scheduled connections, and uses least-privilege replication with a read-only source. Even if production fully falls, the backup stays in your control.
LAYER 04
Restore to pre-infection
Once ransomware is found, pick any point before encryption from history and restore clean data in one click. The retention window is your detection and response window.
Even if the attacker takes every key you have
The backup credential they hold can write but not delete; the encrypted content they write becomes a new version that cannot overwrite the old one; and the old version, protected by Object Lock, cannot even be deleted. The data always comes back.
Native vs Baiyuan
Native features are just the engine, the protection is our layer
The storage engine provides mechanisms, but a mechanism is not the same as usable, defensible, and visible. Below, item by item, is what native does versus what Baiyuan adds. That layer is where the value lives.
Undelete
Native: versioning exists, but you dig through versions and identify delete markers yourself.
Baiyuan: the console flags "deleted, recoverable" directly and restores in one click, no engine knowledge needed.
Backup setup
Native: raw command-line only, with no backup concept in the UI.
Baiyuan: one-click onboarding that creates the backup bucket, sets least privilege, runs the first full sync, and manages it as a list.
Backup frequency
Native: daily schedule or real-time replication, each configured separately by hand.
Baiyuan: one continuous control from daily to every N hours to real-time, switched in a single dropdown.
Ransomware defense
Native: provides the Object Lock write-protection mechanism.
Baiyuan: adds change-volume anomaly alerts, automatic backup locking, and least-privilege credential automation, turning a mechanism into a full defense.
Tiering
Native: can only tier by age or size, with no concept of access.
Baiyuan: access-driven automation that tiers only idle data, keeps hot data hot, and moves frequently read data back, close to a cloud smart-tiering experience.
Management and access
Native: a stripped-down, English-only console, with clients left to figure it out.
Baiyuan: a Traditional Chinese console with inline term explanations, plus multi-language SDK samples and Windows File Explorer mounting.
Console Demo
See the console without signing in
This is not a mockup. The interface, modules, and per-zone permission rules come straight from the StorHub console we ship, so this is what you get after deployment. Switch between the hot, cold, and backup zones and the available modules adapt to each zone. The files and figures shown are sample data.
StorHub Object Storage Console
Demo data
This demo covers the console's main modules; a deployed environment also includes uploads, bucket management, and account administration.
Enterprise Deployment
Enterprise deployment: one Helm, the whole stack
Production runs on Kubernetes (K3s / K8s). The three MinIO zones, the management console, daily backup, and monitoring are packaged into one Helm chart and go live in a single command; upgrades, scaling, and self-healing are then handled by the cluster, with no per-machine maintenance.
One-click deploy
helm install brings up the three-zone StatefulSets, the daily backup CronJob, monitoring, and Ingress at once; upgrades roll out gradually and roll back in one click.
High availability
MinIO erasure coding keeps data fault-tolerant so reads and writes continue if a node fails, while K8s handles scheduling, self-healing, and a single entry point.
Unified operations
Many machines managed as one logical computer: automatic restart on failure, centralized credentials, scheduled backups rerun on another node, and one-command upgrade or rollback.
Self-hosted, no lock-in
Supports arm64 and amd64, runs on your own site hardware, keeps data fully on-premises, and meets compliance and isolation needs.
Verified
Not slides, actually recovered
Every disaster scenario is verified with real files and hash comparison of the recovered result, not a claim on a slide.
Delete protection
After deletion on production, the backup file is untouched, and production restores in one click with content identical to the original.
Ransomware recovery
After encryption is overwritten and synced, the backup history still holds the pre-encryption good version for full recovery.
Immutability
Backup versions are WORM-protected, and even an administrator's delete request is rejected.
Data Sovereignty
No cloud, no cross-border, fully on-premises
For finance, healthcare, government, and compliance-sensitive industries, whether data stays in-country and never leaves is often a hard regulatory gate. Self-hosted MinIO keeps data in your own site from end to end, never through a third-party cloud, never across borders, with data sovereignty and audit keys entirely in your hands.
No public cloud
Object storage runs on your own servers; data enters no public cloud, eliminating third-party access and vendor lock-in.
No cross-border
Data stays in-country, meeting personal-data protection, GDPR residency, and national data-sovereignty rules without cross-border transfer risk.
Fully autonomous
Works even offline, with no dependence on external networks or cloud accounts, fitting isolated and air-gapped high-security environments.
Audit-controllable
Access logs, permissions, and encryption keys are all in your hands, so audits get complete, traceable, verifiable evidence.
Compliant retention
With versioning and Object Lock, it meets long-term retention and tamper-evidence requirements such as TFDA five-year retention and audit.
Predictable cost
No cloud egress or API fees, so large volumes or frequent access never get held hostage by a cloud bill.
Real Case · Beauty PIF
Our own compliance platform runs on it
Beauty PIF is Baiyuan's cosmetic Product Information File platform, which automatically produces toxicology safety assessment reports for brands. Under Taiwan TFDA rules these reports must be retained for five years from the last market date and must not be altered, and they carry confidential formulation data. We store the reports in MinIO object storage using exactly the protection described on this page. This is not a demo, it is the live platform running every day.
Prevents | Report loss
Versioning plus undelete means a generated assessment report never disappears from an accidental delete or overwrite, and every one can be recovered.
Prevents | Tampering
Object Lock keeps reports unchangeable during retention, even by an administrator, proving to a TFDA audit that a report has not been touched since it was produced.
Prevents | Cross-tenant leakage
Each brand tenant is isolated with least privilege, so formulations and reports are reachable only by their owner, and other organizations get a 404 even on a download request.
Improves | Re-download anytime
Every report is kept in object storage, so users re-download historical versions for free without regenerating and without being charged again.
Improves | Confident retention
Five-year retention with tamper evidence turns a regulatory requirement into a built-in capability, with a complete, traceable, verifiable record for audits.
Improves | Cost and data sovereignty
Self-hosted with no egress fees, so frequent report downloads never pile up a cloud bill, and the data stays in your own site to meet residency requirements.
Turn "what if the data is lost" into an already-answered question
Baiyuan helps you plan the three-zone architecture, backup frequency, retention policy, and ransomware recovery flow for your environment, with a Traditional Chinese console and client access options, making data protection genuinely deployable, verifiable, and maintainable.