Security

How your backups are kept

• Encrypted in transit (TLS) and at rest (AES-256-GCM), one key per store, keys bound to the store they belong to.
• The master key lives only in the running service's environment. It is not in the database, not in the repository, not in logs.
• Object storage holds ciphertext. The storage provider cannot read your data.
• Integrity drill: stored objects are re-read, decrypted and re-hashed, and a sample of records is compared against your live store. Weekly on paid plans, monthly on the free plan. You get the receipt by email whether it passed or not.
• Retention is enforced automatically and bounded by your plan; erasure on request is immediate and irreversible by design.
• Every read of protected data is logged.

Reporting a problem

If you believe you have found a security issue, write to [email protected] with "security" in the subject. Please include enough detail to reproduce it. We answer every report.