External backup infrastructure
External backups your attacker can’t reach.
Scheduled, encrypted backups that run on your own machines and land in storage you control. If ransomware, a departing employee or a bad migration takes out production, it does not take the copy with it.
No card required. Starting credit on every new workspace.
Sources
A few things, done end to end.
Every source below works on both execution paths and produces an artifact you can restore without us. We would rather ship five that hold than thirty that mostly do.
PostgreSQL
Local or cloud
HTTP endpoint
Whatever it returns
Script
Your machine only
File
Your machine only
Folder
Your machine only
The single point of failure
Most backups share fate with the thing they back up.
Snapshots live in the same cloud account. Replicas answer to the same credentials. A dump written to the same object store is reachable by anything that reached the store. Whoever gets your production access gets all of it, which is precisely the scenario the backup existed for.
The fix is not more copies. It is a copy under different keys, in different storage, on a different trust boundary, that the compromised system has no route to and no permission to delete.
How it works
Point it at a source
A database, an endpoint, a folder, or a script that produces anything you want kept. Declare it in the dashboard, the CLI, or a YAML file you commit.
It runs where you decide
On a worker on your own hardware, so the connection string never leaves your network, or on ours, if you would rather we connected. Same product either way.
It lands somewhere they can't reach
Encrypted before it leaves the machine, written to storage under a retention lock. Compromising your production estate does not compromise the copy.
Custody
Built to hand it back, and not much else.
Encrypted before it leaves
Your public key, applied on the machine that produced the data. We store ciphertext and never hold the private half.
Written under a retention lock
Artifacts are protected for the window you set. Deletion is a policy with a clock, not a button an intruder can press.
Bulk data goes direct
Only metadata passes through our orchestration. The payload moves between your machine and object storage.
You can recover without us.
An artifact describes its own format, compression and encryption, and the procedure to unpack one by hand uses tools already on your machine. This is documented, not implied. A backup you can only open through a vendor is a dependency, not a backup.
Built for operators
Anything in the dashboard is also in the CLI.
Not a subset, and not an afterthought: the same surface is a terminal, a REST API and an SDK. Declare workers and backups in a file, commit it, and reconcile it like the rest of your infrastructure.
CLI referencebackups:
- name: prod-db
kind: local
sourceType: postgres
worker: prod-worker-1
schedule: "0 2 * * *"
retention:
keepLast: 10
expireAfter: 90d
encryptionPublicKey:
valueFrom:
file: ./keys/prod.ascPricing
You pay for what you actually store and move.
No seats, no plan tiers, no annual commitment. Metered on the work done: compute while a backup runs, storage while it is kept, transfer when it moves, and billed monthly.
Start without a card
Every new workspace gets a starting credit and runs under object and retention limits until it is spent. No trial clock.
Getting your data out always works
Downloads keep working even when an account is suspended. Availability is the promise; egress is metered like any other transfer.
Questions