Every feature.
One engine for every database, server and site you run — encrypted into your own storage, scheduled, verifiable and restorable in one click. Here is the whole of it: how the encryption works, who can touch what, how backups run and recover, and every surface you can drive it from.
Zero-knowledge by design.
Backups are sealed before they ever leave the worker, with keys that stay out of your storage. Your data is unreadable to your storage provider — and to us.
AES-256-GCM zero-knowledge encryption
Every backup is encrypted with AES-256-GCM inside the worker before upload. Only ciphertext leaves the pipeline, and the encryption key never touches your storage bucket. What lands in S3 is unreadable without your keys.
Envelope encryption with per-tenant keys
Each organization gets its own data encryption key, wrapped by a master key you never see in plaintext. Rotate or revoke one tenant's key without re-encrypting anyone else's backups — hard cryptographic isolation between orgs, with the AAD bound to the tenant so ciphertext can't be replayed across boundaries.
SHA-256 integrity verification
Every snapshot carries a SHA-256 checksum. Hit Verify and the worker re-downloads and re-checks the artifact, so you know a backup is intact and restorable before the day you actually need it — not after.
Tenant isolation
Connections, storage targets and history are scoped to your organization from the first byte. There is no shared pool where one org can reach another's sources, backups or keys.
Who can touch what.
Team access, second factors and a tamper-evident record of every action — the controls compliance asks for, built in rather than bolted on.
Two-factor authentication (TOTP)
Protect accounts with an authenticator app. Enable TOTP in seconds, save one-time recovery codes, and require a second factor before anyone can reach your sources, storage or restores.
Roles & RBAC
Invite owners, admins and members, each with exactly the access their role allows. Members work day to day, admins manage the org, owners hold the keys — no shared passwords, no over-broad access.
Audit log
A tamper-evident record of who did what and when — logins, invites, backups, restores, schedule and storage changes. Filter by member or action and export it when an auditor comes knocking.
Team invites by email
Invite teammates straight from the dashboard. They get an email link, join your org on signup, and pick up precisely the role you assigned.
Set it, trust it, restore it.
The machinery that turns a one-off dump into a backup regime you can actually rely on — automated, self-pruning, and recoverable in a click.
Cron schedules
Daily, hourly or any cron expression. Set a cadence per source once and the worker runs it on time, every time — no forgotten crontab quietly stopping months ago.
Retention that never deletes your last copy
Keep exactly what you need — old snapshots prune themselves on your policy. Retention will never remove your final remaining backup of a source, so a pruning rule can't leave you with nothing.
One-click restore
Pick a snapshot and a target, confirm, and the worker decrypts, decompresses and replays it — into a separate, empty destination by default so you never overwrite a live database or site by accident.
Streaming backups, constant memory
Dumps flow straight from your database through gzip and chunked AES-256 into storage — no temp files, no disk ceiling. A 50 GB source streams through the worker as easily as a 50 MB one.
Incremental server backups
File-path sources can ship only what changed since the last run, with a fresh full every N runs. Restores replay the whole chain — including deletions — and a daily check proves every link is still in storage.
Point-in-time recovery
Minute-level snapshot schedules dedup unchanged runs, so restoring to any few-minute point costs almost nothing. PostgreSQL goes to the exact second: the server agent archives every WAL segment encrypted, and one command replays your database to the moment just before the mistake.
Automatic retries
Transient failures — a dropped connection, a flaky network — are retried rather than silently lost. A blip doesn't become a missing backup.
Authenticated backup download
Pull a decrypted backup artifact on demand through a short-lived, authenticated link. Grab last night's dump for a local restore or an audit without ever exposing your storage credentials.
Know before it's a 3am problem.
See the health of every schedule at a glance, and hear about a failure the moment it happens — by email, in the dashboard, or over a webhook into your own tooling.
Analytics dashboard
Backup volume, success rates, storage growth and job history at a glance. Spot a failing schedule or a runaway bucket before it turns into an incident.
Email notifications
Get an email on every success and every failure, so a broken backup announces itself instead of waiting to be discovered when you need to restore.
Webhook notifications
Fire backup and restore events at a webhook to wire xbackupman into Slack, PagerDuty or your own pipeline — alerting and automation on your terms.
Dashboard, API, CLI, desktop.
Everything the product does is available however you like to work — click it, script it, or automate it from CI. Same engine behind every surface.
Web dashboard
A polished console for sources, schedules, restores, storage and your team — the whole product in one place, no install required.
REST API
Everything the dashboard does, scriptable over a clean REST API. Authenticate with a Bearer xbm_ key and drive sources, backups, restores, schedules, jobs and storage from CI or your own tooling. See the API reference.
xbm CLI
Automate from any shell — a single static binary with no runtime to install. Configure two environment variables and it talks to the same endpoints as the dashboard.
Desktop app
A native window and tray for macOS, Windows and Linux, for driving your backups without living in a browser tab.
Eleven sources, one schedule.
Databases, servers, whole sites, container volumes, Git hosts, Notion, Kubernetes and object storage — captured by the same encrypted pipeline, on one cadence, into one bucket. Open any source for the full detail on how it is captured and restored.
xbackupman takes logical PostgreSQL backups with pg_dump, compresses and encrypts them inside the worker, and ships the ciphertext to a bucket you own. Any Postgres version, on a schedule, with a checksum you can re-verify before you ever need to restore.
/backup/postgresql →xbackupman backs up MySQL and MariaDB with consistent, single-transaction dumps — a point-in-time snapshot taken without locking your tables. The dump is compressed, encrypted with AES-256-GCM and pushed to storage you own, on the schedule you set.
/backup/mysql →xbackupman captures MongoDB with native archive dumps from mongodump, encrypts them with AES-256-GCM inside the worker, and stores the ciphertext in a bucket you own. Restores use namespace remapping so you can bring a database back beside the original without a collision.
/backup/mongodb →xbackupman backs up any directory on any reachable server over SSH. It tars and compresses the path, encrypts the archive with AES-256-GCM inside the worker, and stores the ciphertext in a bucket you own — no agent to install, just an SSH login.
/backup/servers →xbackupman backs up a WordPress site as a single unit — the files and the database together — so a restore brings back a coherent site, not a mismatched half. Everything is encrypted with AES-256-GCM in the worker and stored in a bucket you own.
/backup/wordpress →xbackupman backs up Docker named volumes by reading them directly from the daemon — no need to stop your containers. The volume contents are tarred, encrypted with AES-256-GCM in the worker, and stored in a bucket you own.
/backup/docker-volumes →xbackupman captures Redis as a point-in-time RDB snapshot pulled directly from your instance, compresses and encrypts it with AES-256-GCM inside the worker, and ships the ciphertext to a bucket you own — on the schedule you set.
/backup/redis →xbackupman mirror-clones every repository under a GitHub, GitLab or Gitea account — code, branches, tags and all — into one encrypted archive stored in a bucket you own. A read-scoped access token is all it needs.
/backup/git-repositories →xbackupman exports every page and database your Notion integration can access — including full recursive block trees — into a single JSON snapshot, encrypted with AES-256-GCM and stored in a bucket you own.
/backup/notion →xbackupman snapshots every resource manifest in your cluster — Deployments, Services, ConfigMaps, Secrets, Ingress, PVCs, RBAC and more — into one encrypted YAML archive stored in a bucket you own. A read-only kubeconfig is all it needs.
/backup/kubernetes →xbackupman replicates an S3-compatible source bucket to a destination storage target of your choice — incrementally, on a schedule — so a provider outage or a bad deploy can't take your objects with it. No servers to manage, no code to write.
/backup/storage-replication →