Synology backup to S3-compatible storage

A Synology NAS is an excellent foundation for your data, but on its own it's not a complete backup. With OtterStorage you add the missing piece: an external, S3-compatible and immutable copy that your DSM can manage natively with Hyper Backup and Cloud Sync.

The problem

Many people entrust all their data to a single NAS, often with the false sense of security that RAID provides. But RAID protects against a single disk failure, not against the disasters that really erase data:

• Fire, flood or theft: if the NAS physically disappears, all its internal copies disappear with it.
• Ransomware: malware that encrypts the NAS volumes also reaches local copies and mounted shared folders.
• Human error: an accidental deletion or a misconfiguration can propagate to all local replicas.

The 3-2-1 rule sums up the best practice: 3 copies of the data, on 2 different types of media, with at least 1 copy offsite. A NAS alone doesn't cover that "1".

The OtterStorage solution

OtterStorage is object storage compatible with the S3 API. Your Synology treats it as a standard S3 destination, so you can replicate volumes and folders to an external bucket with no additional software: everything is managed from DSM.

• A real offsite copy: your data lives in our infrastructure, physically separated from the NAS.
• Optional immutability: with Object Lock (OtterVault) and bucket-level Legal Hold, copies cannot be altered or deleted within the retention period, not even by ransomware or compromised credentials.
• No charges for requests or deletes: you pay for what you store; upload, list and delete operations are not billed. This matters a lot with Hyper Backup, which generates many small requests.
• Compatible with DSM: it works with Hyper Backup (versioned copy) and with Cloud Sync (continuous synchronization).

If you want to dig deeper into backup strategies, also review our backups guide and the documentation.

How to set it up

Before you start you need a bucket in OtterStorage and its credentials (access key + secret key), which are generated per bucket. Also note the endpoint and the region:

Endpoint S3:   es-mad-1.s3.otterstorage.io
Región:        eu-mad
Bucket:        synology-backup       (el nombre que elijas)
Access Key:    el de tu bucket
Secret Key:    el de tu bucket

Option A — Hyper Backup (versioned copy, recommended)

Hyper Backup makes deduplicated, versioned copies. It's the ideal option for backup. Steps:

1. Open Hyper Backup in DSM and click + → Data backup task.
2. For the destination, choose S3 Storage.
3. In S3 Server select Custom Server URL / S3 Compatible (don't pick a provider from the list).
4. Fill in the connection fields with these values:

   Server address:      es-mad-1.s3.otterstorage.io
   Signature Version:   v4
   Bucket name:         synology-backup
   Access Key / ID:     (el de tu bucket)
   Secret Key:          (el de tu bucket)

5. If DSM offers it, keep HTTPS enabled; the endpoint uses https:// by default.
6. Select the shared folders and applications you want to back up.
7. In the task settings, enable client-side encryption and store the recovery key in a safe place.
8. Configure the schedule (for example, daily overnight) and the version rotation (Smart Recycle is usually a good option).
9. Finish the wizard and launch the first backup. The initial one will take time depending on your upload speed; later ones will be incremental.

Option B — Cloud Sync (continuous folder synchronization)

If what you want is to keep specific folders always in sync (closer to a mirror than to a versioned backup), use Cloud Sync:

1. Install and open Cloud Sync from the Package Center.
2. As the provider choose S3 Storage and, within it, Custom Server URL / S3 Compatible.
3. Enter the same connection values:

   Server address:   es-mad-1.s3.otterstorage.io
   Access Key:       (el de tu bucket)
   Secret Key:       (el de tu bucket)
   Bucket:           synology-sync

4. Choose the local folder, the sync direction (recommended: upload local changes only so the NAS isn't overwritten from the cloud) and confirm.

Note: Cloud Sync replicates the current state; if a file is encrypted by ransomware on the NAS, that change may propagate. For protection against that scenario, combine it with versioned Hyper Backup and/or with Object Lock on the bucket.

Immutability with Object Lock

So that not even you (or an attacker with your credentials) can delete the copies within a period, create the destination bucket with Object Lock (OtterVault) enabled and define a retention. You can also apply Legal Hold at the bucket level when you need indefinite retention. Check the details in the documentation.

Recommendations

• Encrypt client-side: enable encryption in the Hyper Backup task so your data travels and is stored encrypted with your key.
• Schedule off-hours: run backups overnight so they don't compete with NAS usage or your upload bandwidth.
• Use Object Lock for immutability: it's your best defense against ransomware and accidental deletions.
• Verify restores: periodically test a partial restore; a backup that hasn't been tested is not a backup.
• Take advantage of no charges for requests or deletes: you can keep frequent rotations and verifications with no penalty on the bill.

Benefits

• Truly offsite: you complete the 3-2-1 rule with an external copy independent of the NAS.
• Immutable: Object Lock and Legal Hold protect your copies against malicious encryption and deletion.
• No cost surprises: no charges for requests or deletes; you pay for storage.
• Native in DSM: compatible with Hyper Backup and Cloud Sync, with nothing external to install.
• Simple and portable: being standard S3, your data isn't trapped in a proprietary format.