A method for replicating data in a client-based replication system comprising a plurality of data servers and a replication controller, wherein each of the data servers is associated with one or more data stores, and each data store includes at least one replication data set comprising a hierarchy of file objects, the method comprising: receiving, in a client computing device having a processor and a memory, in response to a request specifying objects to be replicated, a replication layout from the replication controller, wherein a replication layout describes, for the client computing device and the replication controller, (a) objects the client computing device can replicate, and (b) a set of data servers of the plurality of data servers including said objects and the locations of said objects in the system; responding, in the client computing device, to a request to initiate a data replication process at each data server of the set of data servers according to the replication layout by initiating the data replication process; transmitting, from the client computing device, instructions to each data server of the set of data servers to perform respective replication operations at said data server modifying objects to be replicated in the hierarchy of objects in the replication data set associated with said data server; receiving, in the client computing device, from each of the data servers of the set of data servers, following the termination of respective replication operations, a respective signed integrity assertion, signed based on a respective cryptographic identity of the data server, wherein each respective integrity assertion comprises a hash value of a root object of the hierarchy of objects in the replication data set at the respective data server, the hash value of the root object formed from a hash tree corresponding to the hierarchy of objects; transmitting, from the client computing device, the signed integrity assertions to the replication controller; in the replication controller, evaluating each signed integrity assertion, based on the corresponding cryptographic identity and the respective hash value, to confirm that the signed integrity assertion originated at the corresponding respective data server and to determine that the data replication process was performed successfully for the corresponding respective data server if the integrity assertions at each data server match; and receiving, in the client computing device, from the replication controller an indication of whether the replication was successful. receiving, in a client computing device having a processor and a memory, in response to a request specifying objects to be replicated, a replication layout from the replication controller, wherein a replication layout describes, for the client computing device and the replication controller, (a) objects the client computing device can replicate, and (b) a set of data servers of the plurality of data servers including said objects and the locations of said objects in the system; responding, in the client computing device, to a request to initiate a data replication process at each data server of the set of data servers according to the replication layout by initiating the data replication process; transmitting, from the client computing device, instructions to each data server of the set of data servers to perform respective replication operations at said data server modifying objects to be replicated in the hierarchy of objects in the replication data set associated with said data server; receiving, in the client computing device, from each of the data servers of the set of data servers, following the termination of respective replication operations, a respective signed integrity assertion, signed based on a respective cryptographic identity of the data server, wherein each respective integrity assertion comprises a hash value of a root object of the hierarchy of objects in the replication data set at the respective data server, the hash value of the root object formed from a hash tree corresponding to the hierarchy of objects; transmitting, from the client computing device, the signed integrity assertions to the replication controller; in the replication controller, evaluating each signed integrity assertion, based on the corresponding cryptographic identity and the respective hash value, to confirm that the signed integrity assertion originated at the corresponding respective data server and to determine that the data replication process was performed successfully for the corresponding respective data server if the integrity assertions at each data server match; and receiving, in the client computing device, from the replication controller an indication of whether the replication was successful.