Your data stays in your bucket and Mixedbread searches it for you. Your cloud persists source documents, chunks, metadata, and the index, encrypted with your own key. Mixedbread writes to and reads from your bucket only in memory—ingesting, preprocessing, embedding, and retrieving on ephemeral compute with zero content retention—and stores only usage metering, never your content.

Your cloud

Mixedbreadin-memory · zero retention · no content logs

Data sources & appsdocuments & queries

Object storagesource docs & chunks · metadata · index
encrypted with your own key

Ingestion & query APIconnectors or REST

Preprocessingparsing & chunking · in-memory

Embedding inferenceruns on our compute · ephemeral

Retrieval enginelate-interaction scoring · in-memory cache

Usage meteringbilling metadata only · never your content

writes / ingestreads / returns

By default, your data lives in Mixedbread-managed object storage. Bring your own bucket (BYOB) lets enterprise customers use object storage they own and control as the backend instead.

With BYOB, your bucket holds all user content (documents, metadata) and derived artifacts (chunks, generated content, the search index). Mixedbread reads and writes it with ephemeral compute and retains nothing beyond memory: we keep only usage metering for billing.

Supported providers

Other S3-compatible services can work via access keys and a custom endpoint, but aren't officially supported yet. Contact us if you need one, or a provider that isn't listed.

Authentication

For AWS S3, authenticate one of two ways:

• IAM role (recommended). Mixedbread assumes a cross-account role in your account via STS, scoped with a unique external ID. We do not store any long-lived secrets. Access can be granted or revoked entirely through the role's trust policy.
• Access keys. An access key ID and secret. Keys are encrypted at rest, never returned by the API, and can be rotated at any time. Use this for S3-compatible endpoints.

Encryption

Data is encrypted in transit and at rest. If your bucket uses SSE-KMS, provide the KMS key ARN and grant the role or identity Mixedbread uses kms:Decrypt and kms:GenerateDataKey on that key. Mixedbread encrypts writes with your key, so you hold the encryption material and can revoke it at any time. Omit the key to use the bucket's default encryption.

The KMS key is fixed when you connect the bucket and can't be changed afterward, because objects stay encrypted under the key they were written with. To switch keys, recreate the connection.

Zero Data Retention

Every BYOB deployment runs under Mixedbread's Zero Data Retention (ZDR) architecture automatically. There is nothing to enable. Because your documents, derived artifacts, and index live in your bucket, Mixedbread-controlled storage never holds your content, and our logging and observability systems are configured not to retain it.

Once your bucket is connected, Mixedbread issues a ZDR attestation for the deployment. Download it from the Bucket page in your organization settings and hand it to your security, legal, or procurement team. It names your organization and deployment, carries a unique attestation ID, and stays in effect for as long as the deployment uses BYOB.

Mixedbread keeps only operational telemetry (request and trace IDs, timestamps, status codes, latency, and the usage counters that drive billing), none of which contains your content.

What Mixedbread does not retain

Nothing in the list below is written to Mixedbread-controlled persistent storage:

• Source documents, files, images, audio, or video
• Extracted text or document chunks
• Embeddings or other content-derived representations
• Search queries or natural-language prompts
• Metadata fields you supply with indexed documents or search requests
• Search results or retrieved passages
• Model inputs, prompts, outputs, or generated responses containing your content
• Intermediate model representations containing your content
• Temporary copies of your content after processing has completed
• Your content in application logs, traces, debugging, analytics, or observability tooling

Your content may be held transiently in memory or other ephemeral compute only for the time required to process the operation, and is never written to Mixedbread-controlled persistent storage. It is not used for model training, human review, or product improvement.

Setup

Once connected, new stores point to your bucket automatically.

Does BYOB affect performance?

No. Keep your bucket in us-east-1, colocated with Mixedbread's compute, and indexing and search perform the same as without BYOB. Buckets in other regions work but add cross-region latency and data-transfer cost.

What happens to my existing stores?

Connecting a bucket changes where new content lives; it does not move existing data.

• Stores created after setup persist all content in your bucket.
• Stores created before setup keep reading and writing from the Mixedbread-owned bucket; they are not migrated.

To move existing data into your bucket today, recreate those stores after connecting it. Automated migration of existing stores is coming soon.

What does it cost?

• Mixedbread charges for the compute cost of indexing and search.
• You pay your cloud provider directly for the bucket's storage, requests, data transfer, and any encryption services you use (such as KMS).

How do I revoke access?

You control access from your own cloud and can revoke it at any time. How quickly Mixedbread loses access depends on how you revoke it:

• Access keys. Once you deactivate or delete the key, Mixedbread loses access within a few minutes (AWS IAM is eventually consistent).
• IAM role. Once you remove the trust policy, Mixedbread can no longer obtain new credentials. Because it uses short-lived STS sessions, any session it already holds expires shortly after; to cut access immediately, use IAM's revoke active sessions.

After Mixedbread loses access, your stores and files are no longer reachable from our service. Content already loaded into the retrieval engine may stay in an ephemeral in-memory cache for a short period until it is evicted.

What if Mixedbread loses access by accident?

If your IAM role refuses Mixedbread, for example after a trust policy change, the bucket's status in the dashboard switches to Error. While it is in that state, uploads and new stores are rejected with a bucket_unavailable_error instead of being written to Mixedbread-owned storage. Restore the trust policy, then use Re-check access in your organization's bucket settings. Mixedbread repeats the validation probe and the bucket becomes active again.