Why your backups should live in YOUR storage
Handing your backups to a vendor's black-box bucket trades one single point of failure for another. Here's why owning the storage — and the keys — changes the math.
Most backup products quietly assume one thing: that you'll let them hold your data. You point them at a database, they encrypt it (maybe), and it lands in a bucket they own, in an account you can't see, under terms you don't control. It's convenient right up until the day it isn't.
The problem with vendor-owned buckets
When the vendor owns the storage, your backups inherit every one of the vendor's risks. If their account is suspended, your restores stop. If they raise egress prices, your disaster-recovery plan gets more expensive overnight. If they get breached, your data is in the blast radius. And if they simply go away — acquired, shut down, pivoted — you may have days, not months, to get your data out.
You also lose the one property that makes a backup a backup: independence. A copy of your data that lives inside the same trust boundary as the thing backing it up isn't a second copy, it's a liability with extra steps.
What "your storage" actually buys you
xbackupman inverts the model. You connect your own object storage — Amazon S3, Cloudflare R2, Backblaze B2, MinIO, anything S3-compatible — and every backup lands there. We orchestrate the machinery; you own the bytes.
- Sovereignty: the data sits in your cloud account, under your billing, your region, your compliance posture.
- Portability: cancel us tomorrow and your backups are still sitting in your bucket, in a format you can read.
- Cost control: you pay your storage provider directly, at your negotiated rates, with no per-GB markup.
- Blast-radius isolation: a compromise of our systems never grants access to your storage credentials in plaintext.
Keys never leave, either
Ownership of the bucket only matters if you also own the encryption. Backups are encrypted with AES-256-GCM inside the worker, before a single byte leaves for your storage. With per-tenant envelope encryption, each organization's data key is wrapped by a master key — so even we can't read your ciphertext at rest.
The result is a backup you can actually reason about: your data, in your storage, under your keys. We're the automation, not the custodian.
The test to apply to any backup vendor
Ask a simple question: if this company disappeared overnight, could I still restore? If the honest answer is no, you don't have a backup — you have a dependency. Owning your storage is how you make the answer yes.