Skip to main content

CoreWeave AI Object Storage

Highly reliable, performant Object Storage designed for AI workloads

CoreWeave AI Object Storage is a purpose-built object storage solution for storing and loading training code, checkpoints, and model weights. It efficiently serves data directly to GPU Nodes through an S3-compatible API, and via model serializers, such as CoreWeave Tensorizer. AI Object Storage works in conjunction with CoreWeave's Local Object Transfer Accelerator (LOTA), a first-of-its-kind, Node-local connection to Object Storage that enables a hyper-efficient path for object data to the GPU, while caching data on GPU Nodes to additionally reduce load times.

Availability​

CoreWeave AI Object Storage is available in multiple regions across the CoreWeave platform.

See Regions and Availability Zones for the most up-to-date information on where AI Object Storage is available.

Security​

CoreWeave AI Object Storage is designed to safeguard information that requires secure, reliable containment for long periods of time. AI Object Storage offers superior reliability by providing high redundancy, versioning, and bucket security policies.

  • Encryption at rest: All data stored in AI Object Storage is encrypted at rest using industry-standard encryption algorithms (AES-XTS-512). See the Encryption section below for more details.
  • Versioning for backups and archiving: CoreWeave AI Object Storage supports versioning, allowing multiple versions of data to be stored. This is useful for data recovery, and is an effective method for tracking changes over time. If required, clients can also revert to previous versions of data. AI Object Storage is ideal for archiving, backups, and use cases where data requires long-term, low-risk resiliency.
  • Organization, bucket, and lifecycle policies: AI Object Storage uses organization, bucket, and lifecycle policies to enforce access control and configure retention.
  • Platform independent: Customers can use CoreWeave AI Object Storage independently of Cloud provider infrastructure, making it a flexible option for multiple use cases and environments. CoreWeave AI Object Storage can also be connected to multiple storage backends across Cloud providers, offering a high degree of availability.

Encryption​

AI Object Storage employs robust encryption practices to protect your data throughout its lifecycle. Below, you will find a detailed overview of the default encryption methods, compliance standards, operational caveats, and in-transit security features. These practices are designed to address both the performance needs of AI/ML workloads and the stringent requirements of data security.

Default Encryption at Rest​

  • Object Data Encryption and Metadata Handling: All object data stored within AI Object Storage is encrypted at rest by default, using the AES-XTS-512 algorithm. This mode applies two independent 256-bit keys per instance and is FIPS 140-3 Level 1 capable. Note that only the object data itself is encrypted at rest; object metadata is not encrypted by default. Customers should ensure confidential information is stored only in object payloads, not metadata fields.
  • LOTA Cache Encryption and S3 SSE-C: For workloads that use the Local Object Transfer Accelerator (LOTA), cached object data on ephemeral storage is encrypted at the drive level using Linux Unified Key Setup (LUKS). Additionally, if you use S3 Server-Side Encryption with Customer Keys (SSE-C), LOTA encrypts and decrypts data directly on the client machine. This ensures that even host root users cannot access cached data without the customer key, providing a layer of protection beyond disk-level encryption.

Encryption in Transit​

  • TLS Usage: Connections to AI Object Storage endpoints support Transport Layer Security (TLS), with TLS version 1.2 or later required for HTTPS. However, use of TLS is optional: users can connect over port 80 without encryption if desired. Data transmitted via HTTPS is protected in transit from interception and tampering.
  • LOTA Proxy Design: LOTA operates as an "untrusted daemon" running on each node and is not deployed with any user or service secrets. Communication between client pods and LOTA, as well as between LOTA instances (pods), is not encrypted by default; the system relies on network segmentation to provide security in these internal communications. When LOTA forwards requests or data to external cwobject.com endpoints, encryption in transit depends on protocol selection: only connections using HTTPS ensure encrypted traffic.
  • Server-Side Encryption with Customer Keys (SSE-C): AI Object Storage supports server-side encryption with customer-supplied keys (SSE-C). This feature allows you to use your own encryption keys to encrypt data while CoreWeave handles the encryption and decryption process.

High performance​

  • Immediately accessible data: CoreWeave AI Object Storage makes data extremely accessible as soon as it has been stored: after writing data to CoreWeave AI Object Storage, clients can re-access and read that data immediately.
  • "Read-after-write": CoreWeave AI Object Storage provides a "read-after-write" function, meaning any read operation after a write operation will retrieve updated data. This allows for secure parallel access, higher performance, and improved scalability.

Metrics and logging​

CoreWeave plans to offer audit logging and other metrics in the near future, but they are currently unavailable for this release. If you have specific questions about observability, please contact CoreWeave support.

Get started​

Last updated on