Versity S3 Gateway: Object Storage Ledger 2026 Scorecard

Part of the Object Storage Ledger (edition 2026-10-16). How the scores work: methodology.

Snapshot

Type: engine (open-source S3 gateway; Versity sells it with ScoutAM, ScoutFS and its S3 Tape Archive Engine)
Owner: Versity Software, Inc., San Jose, California (private; ownership and funding not published on its site)
Licence: Apache 2.0; the gateway is free; Versity's archive products are quote only with "unlimited capacity licensing" and no published prices
Latest release: v1.9.0 (2026-10-13)
Support lifecycle: None published; community support on GitHub, enterprise support through Versity sales
Next milestone: none published; Versity announced a GPUDirect Tape Gateway in mid 2026 without a GA date
Object lock: Object Lock with retention and legal hold: permissions for both checked from v1.5.0, default retention limits validated in v1.6.0, default retention migration and enforcement on browser POST uploads in v1.9.0 (releases). The lock holds only as far as the backend file system or service protects the files; no backup vendor validation found
Tier: Open-source engine
Archetype: Dependable builder, young
Evidence grade: B. The GitHub release page for v1.2.0 to v1.9.0, the repository metadata, the README and versity.com were read (grade B for 2026). Releases from 2023 to 2025 were not fetched, so the first-year state is inferred from the README and the repository date (grade C). Some release years on the GitHub page were inferred by the research tool.

Scope of the scores: VersityGW is a stateless translator between the S3 API and a backend: a POSIX file system such as ScoutFS, Azure Blob or another S3 service. Durability, capacity and much of the immutability guarantee come from the backend it fronts, so those domains are scored for what the gateway adds on its own. Versity's commercial archive and tape products are not scored.

Scorecard

Dimension	Score	Direction
Capability today	56.6 / 100	higher is better
Momentum since 2023	+15.7 points	higher is better
Credibility	16.0 / 25	higher is better
Commercial risk	not scored (engine: nothing to buy)
Technical lock-in	3.0 / 25	lower is better
Integrator fit	8.0 / 20	higher is better
AI leverage	3.0 / 20	higher is better
Ledger Index	59.6 / 100	balanced weights; see the methodology

Capability by domain, 2015 to today

Scores 0 to 5 against fixed anchors; total is weighted to 100.

Domain (weight)	2015	2019	2022	Today
S3 API fidelity (15)	n/a	n/a	n/a	3.5
Immutability and compliance (12)	n/a	n/a	n/a	2.5
Durability and resilience (12)	n/a	n/a	n/a	2
Performance and scale (12)	n/a	n/a	n/a	3
Deployment freedom (10)	n/a	n/a	n/a	4
Security and multi-tenancy (10)	n/a	n/a	n/a	3
Operations (10)	n/a	n/a	n/a	2.5
Protocols beyond S3 (7)	n/a	n/a	n/a	2.5
Lifecycle and tiering (7)	n/a	n/a	n/a	1.5
Ecosystem and openness (5)	n/a	n/a	n/a	3.5
Total / 100	n/a	n/a	n/a	56.6

Year by year: 2023: 40.9 · 2024: 40.9 · 2025: 40.9 · 2026: 56.6

What moved the score

Year	Domain	Change	Points	Trigger
2026	Deployment freedom	3.5 → 4	+1.0	v1.4.0 (2026-04-02): Helm chart for Kubernetes
2026	Immutability and compliance	0 → 2.5	+6.0	Object Lock with retention and legal hold, permission checks (v1.5.0), default retention validation (v1.6.0) and enforcement on POST uploads (v1.9.0); root on the backend can still remove files and no backup vendor validation found; first release with Object Lock not identified
2026	Operations	2 → 2.5	+1.0	v1.2.0 (2026-02-09): web UI; v1.3.0 multi-address listeners; metrics, upgrade documentation and a support lifecycle not found in sources read
2026	Performance and scale	2.5 → 3	+1.2	S3 over RDMA (vgwrdma with NVIDIA cuObject and hipObject) in the README with maturity not stated, counted as half a step; POSIX concurrency limiter in v1.3.0; no sizing guide or benchmark found
2026	S3 API fidelity	2 → 3.5	+4.5	1.x releases in 2026: versioning, multipart, tagging, bucket policies, presigned and POST policy uploads (v1.4.0), more checksum algorithms (v1.5.0), static website hosting (v1.6.0), standalone IAM service and STS web identity (v1.8.0), if-match and if-none-match policy keys (v1.9.0); lifecycle and SSE not found
2026	Security and multi-tenancy	2 → 3	+2.0	v1.5.0 permission checks for tagging, legal hold and retention; v1.7.0 LDAP filter injection fix; v1.8.0 (2026-09-04) standalone AWS-compatible IAM service and STS web identity federation; SSE with an external KMS and audit logs not found

Direction, 2023 to 2026

Each release item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).

Date	Item	Theme	Driver
2023-05	Repository opened under Apache 2.0: S3 front end for POSIX file systems	Ecosystem	P
2026-02	v1.2.0: web UI, ListMultipartUploads delimiter, delete marker fixes	Operations	C
2026-03	v1.3.0: ListObjectVersions fix, multi-address listeners, POSIX concurrency limiter	Performance	C
2026-04	v1.4.0: Helm chart and browser POST uploads	Deployment	C
2026-06	v1.5.0: more checksum algorithms; tagging, legal hold and retention permissions checked	Immutability	C
2026-06	v1.6.0: Object Lock default retention limits validated; static website hosting	S3 API	C
2026-07	v1.7.0: suspended bucket null version fix; LDAP filter injection fixed	Security	C
2026-08	GPUDirect Tape Gateway announced by Versity; GA not stated	AI	V
2026-09	v1.8.0: standalone AWS-compatible IAM service and STS web identity federation	Security	C
2026-10	v1.9.0: Object Lock default retention migration, lock enforced on POST uploads, POSIX directory-object versioning, opt-in fsync	Immutability	C
2026-10	S3 over RDMA through NVIDIA cuObject listed in the README; maturity not stated	Performance	V

Centre of gravity: Performance (2), Immutability (2), Security (2)
Blind spots (no items): Durability, Protocols, Lifecycle, Packaging, Licensing
Driver mix: Vision 18%, Customer need 73%, Market window 0%, Upstream 0%, Portfolio 9%
Idea-to-need index: 0.20 (0 = demand-pulled, 1 = thesis-pushed)

Credibility: 16.0 / 25

Criterion	Score	Basis
Cadence	4	Eight 1.x releases from February to October 2026, roughly monthly; no published rhythm
Roadmap transparency	2.5	Public GitHub repository and release notes; no roadmap
Say-do	3	Little announced ahead of release; the GPUDirect Tape Gateway and RDMA support carry no GA statement
Velocity	4	Several substantive items per release in 2026: web UI, Helm, IAM service with STS, Object Lock hardening
Lifecycle stability	2.5	No support policy or maintained branches published; steady semantic versioning

Commercial risk: not scored

This is an engine: nobody sells it, so there are no commercial terms to score.

Technical lock-in: 3.0 / 25 (lower is better)

Criterion	Score	Basis
Formats	0.5	Objects are plain files on the backend; versions in a separate directory; metadata in extended attributes or sidecar files
Export path	0.5	Read the files from the backend file system directly, or use S3
Stack coupling	1	Needs a backend file system or object service; none is mandated
Hardware / cloud coupling	0	Any server, several operating systems, amd64 and arm64
Skills and tooling coupling	1	POSIX and S3 skills

Integrator fit: 8.0 / 20

Criterion	Score	Basis
Partner programme openness	1.5	No partner programme found; Dell and Spectra Logic named as partners
Multi-tenancy and self-service	3	Multi-tenant IAM accounts with LDAP, a standalone IAM service and STS (v1.8.0); quotas not found
API and infrastructure-as-code	2.5	Admin CLI and API, Helm chart; no Terraform provider or operator found
Skills and certification	1	No training or certification found

AI leverage: 3.0 / 20

How the product uses AI, scored per year like capability. Only GA counts.

Criterion	2019	2022	Today	Latest step
AI workload support	n/a	n/a	1.5	2026: S3 over RDMA through NVIDIA cuObject and hipObject in the README, maturity not stated (half step); GPUDirect Tape Gateway announced without GA
AI platform stack	n/a	n/a	0	2023: None
AI-assisted operations	n/a	n/a	0	2023: None
Agent openness	n/a	n/a	1.5	2023: S3 and admin APIs that agents can drive; no MCP server found

Year by year: 2023: 2.5 · 2024: 2.5 · 2025: 2.5 · 2026: 3

AI say-do, 2023 to 2026: 2 AI items announced; 0 GA, 0 still preview, 2 pending, 0 dropped. S3 over RDMA appears in the README without a maturity statement, and the GPUDirect Tape Gateway was announced in mid 2026 (date given as 2026-07-30 or 2026-08-04) without a GA date.

VersityGW's AI angle is the data path: RDMA for S3 and a GPUDirect route to tape, neither with a stated GA. It uses no AI in its own operation.

Reading

VersityGW scores well where a gateway can: S3 surface, deployment on almost any host, and very low lock-in, because objects stay as plain files on the backend. It scores low on durability, lifecycle and operations because it adds no protection of its own, no lifecycle rules were found, and the web UI only arrived in 2026. Immutability is 2.5: the Object Lock code is active and hardened release by release, but anyone with root on the backend file system can remove the files, and no backup vendor validation was found. A buyer should judge it together with the backend it fronts, and ask Versity which backend configurations it supports for Object Lock before using it as an immutable backup target.

Open questions and items to re-score

The v1.0 date and the release that first shipped Object Lock; releases from 2023 to 2025 were not fetched, which is why 2024 and 2025 have no direction items.
Whether it passes Veeam, Commvault or Proxmox Backup Server S3 tests.
Metrics, audit logging and SSE with an external KMS were not found in sources read.
Maturity of S3 over RDMA and the GA date of the GPUDirect Tape Gateway.
Metadata layout (extended attributes versus sidecar files) per backend.
Ownership and funding of Versity Software.