Introducing Soft Delete for Tigris Buckets and Objects
Today we're shipping soft delete for Tigris buckets and objects. When you turn it on for a bucket, deletes stop being permanent. They go into a holding state for a retention window you set, anywhere from 7 to 90 days. Restore inside that window and the bucket or object comes back. Wait the window out and Tigris removes the data on its own.
A wrong delete is no longer a one-way door. Work that used to need a staging environment or a careful permissions audit can happen on the real bucket, because if something goes wrong, you have a few days to fix it.
Deletes go into a holding state
Retention is set per bucket. Turning soft delete off later doesn't purge data that's already in the holding state. That data keeps aging out on the schedule it was created with. While a bucket itself is in the holding state, its name stays reserved. You can't reuse the name until the bucket is restored or fully removed.
Your agent writes get a safety net
Tigris already gives you snapshots and forks when you want to isolate an agent's work into a copy of the bucket. Soft delete adds another option for the cases where the agent or CI job writes directly to a real bucket. Any delete it makes is recoverable inside the retention window. A coding agent cleaning up stale prefixes, a pipeline rotating documents in a RAG corpus, a CI job resetting test fixtures between runs. All of these can write directly, and if something goes wrong, you click restore.
It also changes how you run destructive work against production. A lot of teams keep a staging bucket around as an insurance policy for migrations, cleanups, and retention sweeps that touch real data. You run the script there first, watch what happens, point it at production only after you're sure. With soft delete on, the bucket holds its own undo history. You can run the migration directly, watch what breaks, and put back whatever you didn't mean to touch.
And it's not always about recovering from the last mistake. Every delete on a key gets its own restorable version, stamped with the time it happened. So if a bad write goes out and a string of good ones follow, you can still reach back past the noise to the exact prior state you wanted. The good writes stay where they are.
Every version is its own restore point
Inside any bucket with soft delete on, the dashboard splits the file list into All files and Deleted files. Pick a deleted object and the Version history panel opens on the right. It lists every soft-deleted version of that key with a timestamp, version ID, size, and ETag. Click restore on the one you want and the object is live again.
Figure 1. The Version history panel for a soft-deleted object, listing each version with its timestamp, version ID, size, and ETag. Each one is restorable on its own.
Enabling it takes one toggle, one header, or one command
In the dashboard, you can toggle Enable Soft Delete when you create a bucket, or open Bucket Settings → Data Management on a bucket you already have.
Figure 2. Enabling soft delete in the Create Bucket dialog.
Figure 3. Enabling soft delete from Bucket Settings → Data Management.
From the S3 API, set the X-Tigris-Soft-Delete header on CreateBucket. Use
true for the default retention of 7 days, or pass a number between 7 and 90
for a custom window.
func createBucketWithSoftDelete(ctx context.Context, client *s3.Client, bucketName string) error {
_, err := client.CreateBucket(ctx, &s3.CreateBucketInput{Bucket: aws.String(bucketName)}, func(options *s3.Options) {
options.APIOptions = append(options.APIOptions, http.AddHeaderValue("X-Tigris-Soft-Delete", "30"))
})
return err
}
From the CLI, the same setting is a flag on tigris buckets set.
tigris buckets set my-bucket --soft-delete enable --retention-days 30
Restore is one click or one command
On the buckets page, a Deleted buckets segment lists every soft-deleted bucket that's still inside its retention window. Open the row's menu and click restore. The bucket reappears in the regular list. Every object it held when you deleted it is live and readable again.
Figure 4. The Deleted buckets segment in the Tigris dashboard, with a soft-deleted bucket's menu opened to the Restore action.
Objects work the same way. Open the Deleted files segment, pick a version, click restore.
From the CLI, list soft-deleted buckets and restore one by name.
tigris buckets list --deleted
tigris buckets restore my-bucket
tigris buckets delete my-bucket --yes also respects the bucket's soft delete
setting. If soft delete is on, the bucket moves into the holding state and shows
up under tigris buckets list --deleted until you restore it or the retention
window expires.
Your cost won't change
Data in the holding state is billed at the same per-GB rate as live data for as long as it sits inside the retention window. There's no separate add-on fee for turning the feature on. When the window expires and Tigris removes the data, the storage is reclaimed and the bill goes down.
Soft delete is recovery, not backup
Pick a retention window that matches the cycle your team actually operates on. The default is 7 days, which is enough time for most teams to notice that something went wrong and recover. If your incident review runs on a longer cadence, or you want a wider buffer for audits, push the window out to 30 or 60 days. Already soft-deleted data keeps the retention it was created with, so changing the window later only affects new deletes.
Soft delete is recovery, not backup. It protects you against the kind of mistake you can catch inside the window you set. It doesn't protect you against a long-running corruption that goes unnoticed for months, and it doesn't replace whatever you do for long-term retention or disaster recovery. Use it alongside those, not instead of them.
If you're on a snapshot-enabled bucket, soft delete sits underneath snapshots. Deleting a specific version moves that version into the holding state and it shows up in the Deleted files segment, where you can restore it the same way as any other soft-deleted object. A plain delete still records a delete marker and leaves earlier versions live, the same as before.
For the full dashboard walkthrough and the API reference, see the soft delete documentation.
Sign in to the Tigris console and toggle Soft Delete in Bucket Settings → Data Management. Your first 5 GB are free.