Security & Trust
Built to be trusted.
Backups only matter if they're safe, private, and restorable. Here's exactly how xbackupman protects your data — the real controls in the product today, not promises.
AES-256-GCMPer-org keyYour storageSHA-256 verifiedRLS isolationMFA + auditGDPR-ready
01Encryption
Encrypted before it ever leaves.
- Every backup is sealed with AES-256-GCM inside the worker — only ciphertext is ever uploaded.
- Envelope encryption: each organization has its own data-encryption key (DEK), wrapped by a master key. Cross-tenant keys are never shared.
- Ciphertext is bound to your organization id (AEAD additional data), so a blob from one tenant cannot be decrypted in another's context.
- Large sources use a constant-memory streaming cipher (chunked AES-256-GCM) with per-chunk authentication — tamper or truncation fails loudly.
02Your storage
Your data lives in your bucket.
- Backups are written to your own S3-compatible storage (AWS, Cloudflare R2, Backblaze B2, MinIO), a mounted disk, or Google Drive — your account, your control.
- We orchestrate the backups; the backup data does not live on our servers.
- Replicate a single backup to multiple destinations so one provider or region outage can't lose it.
03Isolation
Strict multi-tenant isolation.
- Every tenant query is guarded at the application layer (ownership checks + role-based access control).
- Defense in depth: PostgreSQL Row-Level Security policies scope every tenant table to its organization beneath the app checks.
- Secrets (database passwords, storage keys) are encrypted at rest with your org key — never stored or logged in plaintext.
04Integrity
Backups you can actually restore.
- Every backup carries a SHA-256 checksum recorded at creation.
- Verify re-downloads the artifact and re-checks the checksum, decrypts it, and decompresses it — proving it's intact and restorable before you ever need it.
- Anomaly detection flags a backup whose size deviates sharply from its history, catching a silently-truncated dump before good copies age out.
05Access & audit
Control who does what — and see it.
- Two-factor authentication (TOTP) with backup codes; an org-wide policy can require MFA for every member.
- Roles (owner / admin / member) gate destructive and credential-changing actions.
- An immutable, org-scoped audit log records every mutating action — restores, deletions, key and role changes — and exports to CSV for your auditors.
06Network
Reaches your infrastructure safely.
- The xbm agent backs up on-prem and firewalled data with no open inbound ports, no IP allowlists, and no exposed database.
- Connections can run over SSH, bastion hosts, and secure tunnels.
07Privacy & compliance
Your data, your rights.
- GDPR-aligned: self-service organization data export (no secrets) and full account/organization deletion from the dashboard.
- A Data Processing Agreement is available.
- SOC 2 Type II is on our roadmap; this page describes the controls already in place today.
Found something?
We take security reports seriously. If you believe you've found a vulnerability, email [email protected] and we'll respond quickly.