Ransomware resilient file safe havens for cloud data storage

This disclosure relates to a proxy server for controlling access to a cloud data storage service. The proxy server comprises one or more processors that receive data from a client device via a client mount point over a data network as one or more buffers of a file system object, the one or more buffers representing blocks of the file system object to be stored on physical memory. The processors also write data to the cloud data storage service via a cloud mount point and determine whether the one or more buffers received over the data network contain encrypted data. Finally, the processors, in response to determining that the one or more buffers contain encrypted data, expand the encrypted data contained in the one or more buffers to obstruct writing of encrypted data to the cloud data storage service.