---
title: "SOS: Block SSE-C Encryption per Bucket"
date: 2026-05-29
tags: ["SOS","Storage","Encryption"]
url: https://changelog.exoscale.com/sos-block-sse_c-encryption-per-bucket/
---
# SOS: Block SSE-C Encryption per Bucket

You can now block specific server-side encryption types on your SOS buckets, starting with SSE-C (Server-Side Encryption with Customer-Provided Keys).

When SSE-C is blocked on a bucket, any upload request that includes a customer-provided encryption key is rejected. This gives bucket owners a way to enforce their encryption policy at the bucket level, for example to ensure all objects use SSE-SOS so that data remains readable through replication and other server-side features that are incompatible with SSE-C.

**Starting in 30 days, all newly created SOS buckets will have SSE-C blocked by default.** Existing SSE-C encrypted objects will still remain accessible for retrieval. If you want to re-encrypt them, you will have to upload them again with the new settings configured. It is always possible to block or unblock SSE-C by updating your bucket’s SSE configuration.

![SOS Block SSE-C configuration](sos-block-sse-c.png)

[For configuration details, refer to the SOS documentation](https://community.exoscale.com/product/storage/object-storage/how-to/encryption/?utm_source=beamer&utm_medium=standalone&utm_campaign=SOS-Block-SSE-C-Encryption-per-Bucket&utm_content=ctalink#blocking-sse-c-by-default).