Everything burns.
Your data doesn't.

YOUR SITE — THE APPLIANCE PYRE VAULT — THE BACKEND ┌──────────────────────────────┐ ┌────────────────────────────────┐ │ ESXi / workstations │ │ S3-compatible object store │ │ │ iSCSI / NFS (LAN only) │ │ · bucket versioning ON │ │ ┌─▼─────────────────────────┐│ WireGuard │ · Object Lock (WORM) │ │ │ Pyre appliance VM (OVA) ││ UDP tunnel │ · retention enforced by │ │ │ LIO target / NFS export ││ ═══════════▶│ the storage engine itself │ │ │ block layer → 256K ││ HTTPS + S3 │ │ │ │ objects, write-back ││ API inside │ per-tenant IAM credentials: │ │ │ cache + dirty tracking ││ │ PUT ✓ GET ✓ LIST ✓ │ │ │ crash-safe local cache ││ ══╪══ │ DELETE ✗ EXPLICITLY DENIED │ │ └───────────────────────────┘│ ╳ no │ version-destroy ✗ DENIED │ └──────────────────────────────┘ ╳ delete └────────────────────────────────┘ ╳ path exists

// stack.trace — layer by layer PRESENTATION Linux-IO (LIO) iSCSI target with per-initiator ACLs and mutual CHAP · kernel NFS export — your hosts mount a standard datastore; nothing proprietary touches ESXi. BLOCK ENGINE NBD block device backed by an object-mapping layer: the volume is chunked into 256 KiB blocks, each stored as an individually versioned object. Every overwrite creates a new version; history accumulates by design. CACHE Persistent local write-back cache with dirty-block tracking and crash recovery. Reads and writes complete at local-disk speed; only the async sync crosses the WAN. Backend unreachable? I/O stalls safely — never errors, never corrupts. TRANSPORT WireGuard (UDP, kernel-native). No sessions to stale, no TCP-over-TCP collapse — the tunnel self-heals the instant connectivity returns. S3 API over HTTPS inside. VAULT S3-compatible object storage with bucket versioning and Object Lock in compliance mode. Immutability is enforced by the storage engine — not by policy PDFs. Per-tenant buckets, per-tenant credentials, per-tenant tunnels: nothing shared but the hardware. CREDENTIALS The appliance holds write-only vault credentials with an explicit IAM deny on every destructive operation. A fully compromised customer site — hypervisor, admin passwords, the appliance itself — cannot erase one second of vaulted history. SNAPSHOTS Point-in-time restore = a manifest pinning exact object versions across the volume. The continuous per-second journal that makes every heartbeat addressable is our proprietary layer — the secret sauce ships with GA.