RustFS: Object Storage Ledger 2026 Scorecard

	’26
S3 API fidelity	3
Immutability and compliance
Durability and resilience
Performance and scale
Deployment freedom	1
Security and multi-tenancy
Operations
Protocols beyond S3	2
Lifecycle and tiering
Ecosystem and openness

Part of the Object Storage Ledger (edition 2026-10-16). How the scores work: methodology.

Snapshot

Type: product (Apache 2.0, no paid edition published)
Owner: RustFS, Inc., which holds the trademark (README) and was founded in 2024 per the vendor website; country, investors and funding not published
Licence: Apache 2.0; no commercial edition or price list; enterprise support by contact only
Latest release: 1.0.1 (2026-10-03); 1.0.0 GA on 2026-09-16; 1.0.2-preview.2 (2026-10-16) is a prerelease
Support lifecycle: none published; alpha, beta and release candidate builds until 2026-09
Next milestone: S3 Vectors and a RustFS 2.0 focused on AI, named in the GA post without dates
Object lock: Listed as Available in the README; not mentioned in the 1.0.0 GA post. Modes and legal hold were not confirmed in sources read, and no backup-vendor validation was found
Tier: Open-source software
Archetype: Sharp opportunist, young product
Evidence grade: B. The README feature matrix, the GitHub releases page (1.0.0-rc.5 to 1.0.2-preview.2) and the vendor's 1.0.0 announcement were read in October 2026. Almost every capability score rests on the vendor's own listing of features as Available; no independent test, sizing guide or security audit was found. Release dates on GitHub appear without a year; 2026 is inferred from the GA date and the repository push date.

Scope of the scores: RustFS was open sourced in July 2025 (vendor) and reached 1.0.0 GA on 2026-09-16, so 2025 is scored as alpha: pre-GA capability counts half a step at most. The vendor's figure of 2.7 million deployed instances is a vendor claim and moves no score.

Scorecard

Dimension	Score	Direction
Capability today	59.6 / 100	higher is better
Momentum since 2025	+50.0 points	higher is better
Credibility	14.5 / 25	higher is better
Commercial risk	10.5 / 25	lower is better
Technical lock-in	6.0 / 25	lower is better
Integrator fit	7.0 / 20	higher is better
AI leverage	4.0 / 20	higher is better
Ledger Index	56.4 / 100	balanced weights; see the methodology

Capability by domain, 2015 to today

Scores 0 to 5 against fixed anchors; total is weighted to 100.

Domain (weight)	2015	2019	2022	Today
S3 API fidelity (15)	n/a	n/a	n/a	3
Immutability and compliance (12)	n/a	n/a	n/a	2
Durability and resilience (12)	n/a	n/a	n/a	3
Performance and scale (12)	n/a	n/a	n/a	2.5
Deployment freedom (10)	n/a	n/a	n/a	4
Security and multi-tenancy (10)	n/a	n/a	n/a	3
Operations (10)	n/a	n/a	n/a	3
Protocols beyond S3 (7)	n/a	n/a	n/a	3.5
Lifecycle and tiering (7)	n/a	n/a	n/a	3
Ecosystem and openness (5)	n/a	n/a	n/a	3.5
Total / 100	n/a	n/a	n/a	59.6

Year by year: 2025: 9.6 · 2026: 59.6

What moved the score

Year	Domain	Change	Points	Trigger
2026	Deployment freedom	0.5 → 4	+7.0	1.0.0: binaries for Linux, Windows and macOS on amd64 and arm64, Docker, Helm chart, Nix, RPM and DEB packages; no Kubernetes operator found
2026	Durability and resilience	0.5 → 3	+6.0	1.0.0: MRF heal checkpoint replay, scanner and heal hardening; README lists bitrot protection, healing, bucket and site replication as Available
2026	Ecosystem and openness	2 → 3.5	+1.5	Apache 2.0 without redistribution limits; on-demand migration runtime on by default (rc.6), MinIO on-disk compatibility in preview; outside contributors and third-party validations not counted
2026	Immutability and compliance	0 → 2	+4.8	Object Lock listed as Available in the README; absent from the GA post; no backup-vendor validation
2026	Lifecycle and tiering	0.5 → 3	+3.5	README lists lifecycle rules and tiering to remote S3 as Available; durable quota reservations in 1.0.2-preview
2026	Operations	0.5 → 3	+5.0	Console, OpenTelemetry, pool expansion and decommission; 1.0.1 console URL prefix and enterprise proxy support; no published upgrade policy
2026	Performance and scale	0.5 → 2.5	+4.8	Single node to distributed pools; vendor stress test without numbers; no sizing guide or scale reference found; HTTP/3 QUIC opt-in in 1.0.2-preview
2026	Protocols beyond S3	0 → 3.5	+4.9	Swift, WebDAV, SFTP and FTPS named by the vendor; S3 Tables with an Iceberg REST catalog in preview since 2026-09-10 (half step)
2026	S3 API fidelity	0.5 → 3	+7.5	1.0.0 GA 2026-09-16: README lists versioning, multipart, lifecycle, SSE, KMS, S3 Select and STS as Available; compatibility matrix not read
2026	Security and multi-tenancy	0.5 → 3	+5.0	1.0.0 SSE and KMS blocker fixed; README lists IAM, OIDC, KMS through Vault and AWS KMS, mTLS and audit logging; no public advisory record read

Direction, 2023 to 2026

Each release item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).

Date	Item	Theme	Driver
2025-07	Source opened under Apache 2.0 (vendor)	Licensing	M
2026	MinIO on-disk compatibility behind the rio-v2 feature, in preview	Ecosystem	M
2026-04	Beta release (vendor)	Packaging	M
2026-09	1.0.0-rc.5: performance test workflow, DuckDB REST catalog conformance tests	Performance	C
2026-09	S3 Tables with an Apache Iceberg REST catalog, in preview	Protocols	M
2026-09	1.0.0-rc.6: on-demand migration runtime on by default	Ecosystem	M
2026-09	1.0.0 GA: MRF heal replay, SSE and KMS blocker fix, scanner and heal hardening	Durability	C
2026-09	NVIDIA Inception Program membership (GA post)	AI	V
2026-09	S3 Vectors and RustFS 2.0 focused on AI announced, no dates	AI	V
2026-10	1.0.1: console URL prefix, enterprise proxy support	Operations	C
2026-10	1.0.2-preview: HTTP/3 QUIC opt-in, durable quota reservations, table catalog backups	Performance	C

Centre of gravity: Ecosystem (2), Performance (2), AI (2)
Blind spots (no items): S3 API, Immutability, Deployment, Security, Lifecycle
Driver mix: Vision 18%, Customer need 36%, Market window 45%, Upstream 0%, Portfolio 0%
Idea-to-need index: 0.18 (0 = demand-pulled, 1 = thesis-pushed)

Credibility: 14.5 / 25

Criterion	Score	Basis
Cadence	3.5	Frequent tags; beta in April 2026, release candidates in August, GA on 2026-09-16; no published rhythm
Roadmap transparency	3	Public release notes and a README matrix that marks each feature Available or Preview; direction only in the GA post; no roadmap
Say-do	2.5	GA arrived on the vendor's own timeline; Object Lock is listed as Available but missing from the GA post; S3 Vectors and RustFS 2.0 have no dates
Velocity	4	Large changes in each release candidate and patch since September 2026
Lifecycle stability	1.5	No support window; 1.0 is weeks old and a preview line already runs beside it

Commercial risk: 10.5 / 25 (lower is better)

Criterion	Score	Basis
Price and licence volatility	1	Apache 2.0 since the source opened; no prices published, so no history to judge
Purchase constraints	1	No purchase needed; no paid tier exists
Channel and access	1.5	Open download; enterprise support only by email contact
Owner stability	4	Company founded in 2024 per its website; country, investors and funding not public
Cost of staying supported	3	No support terms or release windows published

Technical lock-in: 6.0 / 25 (lower is better)

Criterion	Score	Basis
Formats	2	Own on-disk layout; MinIO-encrypted objects are not readable by RustFS (README)
Export path	1	S3 API read-out
Stack coupling	1.5	Own cluster and pools; any network
Hardware / cloud coupling	0	Any server on amd64 or arm64
Skills and tooling coupling	1.5	S3 skills transfer; RustFS-specific operations are new to most teams

Integrator fit: 7.0 / 20

Criterion	Score	Basis
Partner programme openness	1.5	No partner programme found; Apache 2.0 lets integrators package and support it freely
Multi-tenancy and self-service	2.5	Multi-tenancy, IAM and OIDC listed as Available in the README
API and infrastructure-as-code	2.5	S3 and admin API, Helm chart; Terraform provider not found
Skills and certification	0.5	No training or certification found

AI leverage: 4.0 / 20

How the product uses AI, scored per year like capability. Only GA counts.

Criterion	2019	2022	Today	Latest step
AI workload support	n/a	n/a	1	2026: S3 store positioned for data lakes and AI; no GPUDirect or RDMA; NVIDIA Inception is a programme membership
AI platform stack	n/a	n/a	0.5	2026: S3 Tables with an Iceberg REST catalog in preview (2026-09-10); S3 Vectors and RustFS 2.0 announced without dates
AI-assisted operations	n/a	n/a	0	2025: None
Agent openness	n/a	n/a	2.5	2026: S3 and admin APIs; MCP named among protocols in the GA post (vendor claim); release status, identity and audit controls not verified

Year by year: 2025: 1.5 · 2026: 4

AI say-do, 2023 to 2026: 4 AI items announced; 0 GA, 1 still preview, 3 pending, 0 dropped. S3 Tables is in preview; S3 Vectors, RustFS 2.0 and the MCP interface have no verified release status; NVIDIA Inception membership is a programme statement with nothing to check.

RustFS markets itself for AI and data lakes, but none of its AI items has reached GA: S3 Tables is a preview, S3 Vectors and a RustFS 2.0 are undated, and MCP support is named without a release status. It has no AI in its own operations.

Reading

RustFS scores as a broad but young S3 server: its README lists versioning, lifecycle, replication, IAM, OIDC, KMS and several file protocols as available, and half of the domains land at 3 on that basis. Performance stays at 2.5 because no sizing guide, scale reference or benchmark with numbers was found, and immutability at 2 because Object Lock appears only in the README and not in the 1.0.0 announcement. Commercial risk sits with the owner: the code is Apache 2.0 with no paid tier, while RustFS, Inc. has not published its country, its funding or any support terms. A buyer should test object lock, healing and upgrades between 1.0 releases on their own hardware before trusting it with backups.

Open questions and items to re-score

Contents of the S3 compatibility matrix in the repository; it was not read.
Object Lock modes and legal hold, and whether Object Lock passes Veeam or Proxmox Backup Server tests.
Owner country, funding and investors; enterprise support terms.
Independent performance tests and a security audit; none found.
Release status of Swift, WebDAV, SFTP and FTPS, which the vendor lists, and of the MCP interface named in the GA post.
The vendor's figures of 2.7 million deployed instances and 32,000 stars (the GitHub API showed 34,991 stars).
Release dates on GitHub appear without a year; 2026 is inferred.