Vault offload (serve protected files from S3 or R2) Pro

A heavy protected library makes your web server do all the serving: every vaulted download streams through PHP. With offload on, vaulted files are mirrored into your connected S3-compatible bucket — Amazon S3, Cloudflare R2, Wasabi, DigitalOcean Spaces, MinIO — and downloads redirect to short-lived presigned URLs. The bucket does the bandwidth; FileDeck keeps doing the access control.

FileDeck Pro — Documents → Settings → Privacy & integrity → Vault offload. Needs the S3 connection (Documents → Cloud storage) with credentials that can write (s3:PutObject) — browsing and attaching only ever needed read.

What actually happens

• The gates come first, always. Access rules, terms, quotas, bot checks — everything runs on your server before the redirect is minted, exactly as when streaming. The presigned URL a visitor receives lasts minutes and names one object.
• Vaulted files are mirrored into the bucket on a daily cycle (capped per day so a large vault drips across days; failures are logged and retried). A file not yet mirrored simply streams locally — availability never depends on the bucket.
• The local file stays. Thumbnails, content search, checksums and watermarking all read local bytes. What offload moves off your server is the recurring cost — download bandwidth and PHP time — not the storage.
• Watermarked serving stays local, deliberately: stamping happens in the stream, and a redirect would silently hand out unstamped files. Stamped beats offloaded.