Console & governance for Amazon S3 and compatible stores

Your files, wherever they already are.

Governed on top, not moved.

Atlas indexes, describes and traces what already lives in your buckets — status, business metadata, links between documents, legal retention — without copying a byte, without a migration, and without ever becoming the only way in or out of your data.

Read the docsView on GitLab
Self-hostedOpen-sourceNo mirrored files
Plate IThe model

A lightweight alternative to AWS S3 Metadata.

In 2024, AWS shipped S3 Metadata — a first-party admission that the raw S3 API was never built to filter, join, or answer relational questions, and needed a queryable layer beside it. Atlas applies the same idea, simplified: self-hosted, on any S3-compatible store, not only AWS — and with a real governance layer on top, not just metadata. See the full comparison, MinIO Console included, on thealternatives page.

Plate IIThe proof

The same bucket, two realities.

Nothing moves. Everything becomes legible.

S3 object
finance/reports/annual-report.pdf
contracts/partner-agreement.pdf
hr/records/employee-file.pdf
archive/export-2025-11.zip
Document, once declared
annual-report.pdfSUCCESS
TaskforceFinancial Analysis
Created byClaire M.
Linked with2 documents
partner-agreement.pdfPROCESSING
TaskforceLegal
Created byJean B.
Linked with—
employee-file.pdfSUCCESS
TaskforceHR Operations
Created bySophie L.
Linked with1 document
export-2025-11.zipSUCCESS
TaskforceArchival
Created byMarc D.
Linked with—
Plate IIIThe structure

Three layers, one source of truth.

Three layers kept deliberately independent, so each can live without the other two. MetaObject is fully reconstructible from S3 at any time — a scan just rebuilds it. Document is the business layer your teams actually drive. See the full model inDefinition.

ground truth

S3 Object

Read live on every request — the physical reality of the bucket.

scan →
technical layer

MetaObject

A reconstructible, queryable cache of every object version.

declare →
business layer

Document

Status, properties, links — frozen the moment it's declared.

Plate IVThe instruments

A governance layer, not a storage layer

Six pieces that fit on top of the model above — each documented with how it works, why it's built that way, and how to configure it.

REST API

A documented, OpenAPI-standard REST API to query and act on your data whenever you want — script it, pipe it into a workflow, or generate a client in any language. No proprietary SDK to learn.

Authentication

Sign in your way — SSO via OIDC, password login, or long-lived API keys for scripts. Pick what fits your setup, wire nothing else up.

Workspace roles

Different roles, granted to a person or a whole OIDC group, checked fresh on every request — no permission is ever left stale.

Signed webhooks

Every governance event can trigger a signed call to your own pipeline the moment it lands — no polling loop, no queue to babysit.

Audit trail & metrics

A record of who changed what, queryable on demand, plus a Prometheus endpoint that's never more than one scrape stale.

Python SDK

A typed client generated straight from the API's own OpenAPI schema — it literally cannot drift from what the API accepts.

Plate VThe parties

Who it's for, and why.

Profile — infra

Administrators

  • Ships as a standard OCI image — runs under Docker or Podman.
  • Deploys to Kubernetes just as easily (no Helm chart published yet).
  • Identity standards done right: OIDC, configurable against any provider — or a custom integration.
  • Structured technical logs on stdout today, with an OpenTelemetry integration on the roadmap.
  • Runs in fully air-gapped environments — no external service, license check, or outbound call required.
  • Full read/write on S3 without leaving Atlas — browse, rename, move, lock.
  • Built on open protocols and boring, proven technology (S3, PostgreSQL).
  • Free, open-source, self-hosted.
Profile — business

Business teams

  • Always know where their data stands: processed or not, by whom, used where.
  • See and set legal retention — hold a document longer when the law requires it.
  • Take back ownership of data governance: traceability, GDPR, cross-border rules.
  • Every action is authenticated and traced, with per-workspace roles for shared work.
  • Link documents together to reconstruct meaning across a messy shared drive.
  • Add, filter and organize by their own business properties.
Profile — data

Data teams

  • Data doesn't have to arrive through Atlas — any S3 connector your stack already uses works as-is, and Atlas discovers new files automatically.
  • One standard entry point, at S3's own security level — nothing duplicated.
  • See real volume, versions included, organized into per-team workspaces.
  • Native S3 compatibility — plugs into every existing pipeline, nothing to rewrite.
  • A Python client generated from the OpenAPI schema to go further on document metadata.
Profile — governance

Governance

  • Business events recorded separately from technical logs — visible and queryable through the audit API, not buried in stdout.
  • An admin panel to supervise workspaces, roles, and activity across the whole instance.
  • Centralized authentication (OIDC / SSO).
  • Fine-grained, policy-based authorization — in progress.
  • No-duplication policy: data only ever lives in one place.
  • Strong traceability: who did what, when, from where.
  • Per-bucket usage statistics, ready for reporting.
  • PostgreSQL underneath — known, standard, easy to back up. Data stays yours to control.
Plate VIWhat it does

What Atlas does, today.

For people who touch S3 every day

Technical & data engineering

Security
  • Configurable encryption and native legal retention (Object Lock).
  • Self-hosted end to end, with centralized SSO.
  • Fine-grained roles and an audit trail nothing in the API can edit or delete.
Observability
  • A live per-bucket view: volume, activity, drift.
  • Signed webhooks straight into your monitoring and pipelines.
  • Every action queryable through the audit API.
Data organization
  • Custom, filterable business properties.
  • Links between documents to reconstruct meaning.
  • Per-team workspaces, mapped one-to-one to buckets.
Resilience
  • Native S3 versioning, restored in one call.
  • Idempotent by design — no operation corrupts existing state.
  • Nothing duplicated — S3 stays the single source of truth.
Example — searching documents
GET /api/v1/documents?workspace=finance&q=report&state=SUCCESS
Authorization: Bearer atlas_...

{ "items": [ ... ], "next_cursor": "MDFhMDI0..." }
For people who've never opened the AWS console

Business users

  • A plain file browser, like any familiar file manager — no need to know S3.
  • Clear visual status on every document (indexed, stale, orphaned) — badges, not jargon.
  • Free-form business properties on every document, filterable in search.
  • Links between documents with a plain-language note (“signed version”, “attachment to…”).
  • Collaborative by design: several teams annotate, link and track the same document without stepping on each other.
  • Plugs straight into the intake chain: business teams drop files in, governance follows behind.
  • Search by business property, not by a technical file name.
  • Legal retention shown in plain terms — how long a document must be kept.
  • A full history of every action, readable without technical background.
Preview — bucket dashboard

128

Documents indexed

312

Objects stored

4

Stale

Plate VIIThe foundations

Built on boring, robust technology.

Atlas doesn't reinvent a single protocol. It assembles open, proven pieces — each one replaceable on its own.

S3

Storage — AWS or any compatible target

OIDC

SSO, any identity provider

TUS

Resumable uploads

HTTP / REST

A documented, versioned API

PostgreSQL

Known, standard, easy to back up

OpenAPI

Client generated straight from the schema

MCProadmap

AI agent integration

Docker / Podman

OCI image

Kubernetesroadmap

Helm chart

Not another storage console

See how Atlas compares to a bucket console like MinIO's, and to fuller platforms like Pydio or Nextcloud.

Compare alternatives
Running in three commands

From clone to a running stack.

Starts Postgres, MinIO (S3-compatible storage), Keycloak (OIDC, for local testing) and tusd (resumable uploads). SeeConfiguration for what everyATLAS_* variable does.

# clone and configure
git clone git@gitlab.com:timothee.bn/atlas.git && cd atlas
cp api/.env.example api/.env  # fill in ATLAS_AUTH_JWT_SECRET at least

# bring the whole stack up
docker compose up -d