Storage
Local NVMe, block volumes and object storage, and how each is encrypted and erased.
There are three places to keep data. Choose by how long it has to live and whether it must survive a hardware replacement.
| Type | Survives node deletion | Typical use |
|---|---|---|
| Local NVMe | No | Datasets staged for a run, scratch, checkpoints in flight |
| Block volume | Yes | Checkpoints, environments, databases |
| Object storage | Yes | Datasets, model weights, artifacts |
Local NVMe
Local drives are self-encrypting. When a node is released, the drive’s media encryption key is destroyed, which makes the previous contents unrecoverable, and the erase is recorded in the node history.
Block volumes
Volumes are NVMe-backed and attach to one node at a time in the same region. Each volume is encrypted with its own key. With a confidential node you can hold that key yourself and release it only after attestation succeeds.
cloister volumes create --size 4TB --region eu-n --name checkpoints
cloister volumes attach checkpoints --to node_7Hq2
Object storage
Buckets are S3-compatible and live in the same facility as your nodes. Transfer between your nodes and your buckets is not billed.
aws s3 cp ./weights s3://acme-weights/ --recursive \
--endpoint-url https://s3.eu-n.cloisterlabs.com
Customer-managed keys
Volume and bucket encryption keys can come from your own key management service. Cloister requests the key when a volume is attached; your service decides, using the node’s attestation evidence, whether to return it.