Encryption keys
Add your own age key to backupd so you can decrypt backups yourself, generate one in the browser or paste a public key, and revoke keys.
Add your own key so every new backup is also encrypted to a key you hold. With it you can open downloaded files and copies in your own bucket without backupd.
Open Settings → Encryption. Owners and admins can add and revoke keys. A workspace can have up to 3 keys.
Add a key
Click Add key, give it a Label (for example Ops team vault), and choose how to create it.
- Click Generate key pair. The key pair is created on your device.
- Save the Secret key. It is shown once. backupd never sees it and can't recover it.
- Download key file saves it as
backupd-<workspace>.agekey, an age identity file you can use withage -d -i. - Or copy it into your password manager and click I copied it somewhere safe.
- Download key file saves it as
- Click Add key.
Only the public key is sent to backupd.
Keep the secret key in a password manager or vault. Anyone with it can read the backups encrypted to it.
Which backups a key opens
A key opens backups made after you added it. It can't open older backups, because each file's encryption is fixed when it is written. For older backups, use Download decrypted in the app.
Your keys
Under Your keys you see each key's label, public key and when it was added. New backups are encrypted to every key listed.
Revoke a key
Click Revoke next to a key. Revoking only affects future backups: backups already encrypted to the key stay readable with it. To fully retire a key, revoke it and delete any backups or bucket copies it should no longer open.
backupd's key
backupd's key shows the public key backupd uses for your workspace. backupd needs it to run restores and restore tests, so it can't be removed.
Next
Use your key to restore without backupd.
How your data is protected
How backupd encrypts backups, who can decrypt them, how database credentials are stored, and how connections are secured.
GDPR and your data
Where backupd processes and stores data, who its sub-processors are, how long data is kept, how to delete your account, and how to keep backups in the EU.