Encrypted PostgreSQL backups.
xbackupman takes logical PostgreSQL backups with pg_dump, compresses and encrypts them inside the worker, and ships the ciphertext to a bucket you own. Any Postgres version, on a schedule, with a checksum you can re-verify before you ever need to restore.
What gets captured
- A complete logical dump — schema plus data — produced by pg_dump against your database.
- Roles, sequences, indexes and constraints, so the dump replays into a clean database as a faithful copy.
- Gzip compression applied in-stream, then AES-256-GCM encryption — the plaintext dump is never written to our disk.
- A SHA-256 checksum recorded with every snapshot for on-demand integrity verification.
How it works
Connect your database
Add a Postgres connection with host, port, database and credentials. Reach private databases over SSH or an allow-listed egress IP. We only need read access to run the dump.
Dump, compress, encrypt
On each run the worker executes pg_dump, streams the output through gzip and seals it with AES-256-GCM. The encryption key stays in the worker — only ciphertext moves.
Ship to your storage
The encrypted artifact is uploaded to your own S3-compatible bucket. We never hold a copy of your data; we orchestrate the pipeline and record the metadata.
Verify and retain
Every snapshot carries a SHA-256 checksum you can re-check on demand. Retention prunes old dumps on your policy — and never deletes your last remaining copy.
Your storage, your keys
Your Postgres dumps land in a bucket you control — AWS S3, Cloudflare R2, Backblaze B2 or self-hosted MinIO. Because the artifact is encrypted before it leaves the worker, even your storage provider sees only ciphertext. You own the data, the bucket and the ability to walk away with everything at any time.
xbackupman never stores your backups on its own servers. It orchestrates the pipeline and records metadata — the encrypted artifacts live only in the S3-compatible bucket you connect. See how encryption works.
One-click restore
Restoring is a logical replay: pick a snapshot and a target connection, confirm, and the worker decrypts, decompresses and applies the dump — into a separate, empty database by default so you never overwrite a live one by accident. Because it is a standard pg_dump artifact, you can also download it and restore with psql or pg_restore yourself.
Questions
QWhich PostgreSQL versions are supported?
Any version pg_dump can reach. Logical dumps are portable across versions, so you can back up an older server and restore into a newer one — a common path for upgrades and migrations.
QWill backups lock or slow down my database?
pg_dump runs in a single consistent snapshot without holding heavy locks on your tables, so reads and writes continue. Point it at a read replica if you want to keep all load off the primary.
QCan I restore into a different database or server?
Yes. A logical dump is not tied to the original host, so you can restore into a fresh database, a staging environment, or a different Postgres server entirely.
QAre large databases handled efficiently?
The dump is streamed and compressed in flight rather than staged whole on disk, so memory stays flat and the encrypted artifact is smaller on upload.
Back up more
One engine covers every source you run — on a single schedule, in one dashboard, encrypted into the same storage.