Bring your own bucket: point us at any S3-compatible bucket and bulk data lives there, on your bill, not ours.
When you save, we check the bucket by writing, reading and deleting a small test object. The secret key is encrypted before it's stored and never shown again.
https://<account id>.r2.cloudflarestorage.com
auto
https://s3.<region>.amazonaws.com
https://s3.<region>.backblazeb2.com
https://storage.googleapis.com
Give the key read, write and delete on this bucket only.