Encrypted before it leaves our worker

Each file is encrypted to every key on your workspace at the time it is made: backupd’s own key, so we can run restore tests and restores for you, and each key you add.

Add your own key in Settings → Encryption, made in your browser or pasted as an age1… public key. Revoking a key only affects future backups; files already made stay readable by it.

There is no mode where only you can open a backup. If you need that, say so: it is on our list.

backupd’s key is unique to your workspace. Its secret half is wrapped with AES-256-GCM under a workspace key, and is only used by our workers to restore and test your backups.

Database credentials and bucket keys are stored encrypted with AES-256-GCM, and handed to the dump tools through environment variables or private option files, never on a command line.

• Every connection uses TLS. Strings that turn TLS off are refused.
• We resolve your host once and pin the address, and refuse private, loopback and link-local ranges, so a connection string can’t be pointed at our own network.
• Read-only users are enough to back up. Uptime checks only open a connection; they never log in.

Backups are kept in backupd Storage, a private bucket only our workers can reach. Download encrypted gives you a link that works for five minutes.

On Pro, copies to your own Amazon S3, Cloudflare R2, Google Cloud Storage, Backblaze B2 or MinIO bucket are made byte for byte. We never decrypt a backup to copy it.

A restore test loads your backup into a throwaway database on a network with no internet access and no route to our app, its database or its keys. PostgreSQL and MySQL backups restore as a throwaway user that owns only that database, so code in a dump can’t act as an administrator. The copy is deleted straight after.

Sign in with a passkey or a password and two-factor codes. New passwords are checked against known breaches. Members have roles, and every action in the workspace, including denied attempts, goes into an audit log nobody can edit, kept for a year.

When backupd support signs in as a member to help, it lasts at most an hour and the audit log shows “backupd support” for everything done.

• HTTPS everywhere, with HSTS. Pages can’t be framed by other sites.
• Session cookies are HTTP-only, secure and same-site, and the API refuses writes that come from other sites.
• Every workspace action checks that you are a member, and what your role allows.
• Webhooks, uptime checks and bucket endpoints are refused when they point at private addresses.

The app, its database, the backup workers and the sandboxes run on Oracle Cloud in Frankfurt, Germany. Backups are stored on Backblaze B2 in the region your workspace picks, including EU Central. See GDPR at backupd for sub-processors, retention and your rights.

Found a security problem? Write to [email protected] with the details. We’ll confirm we got it, fix it, and credit you once it’s fixed if you’d like.