Straight answers.

Every backup is encrypted with AES-256-GCM using its own random key. In standard mode those keys are protected by Backup Safe's server key, which is what lets Backup Safe restore and restore-test your backups without asking you for anything.

In own-key mode the keys are protected by a passphrase only you know. Nobody can read those backups without it, including us. You enter the passphrase when you restore or download; it's used briefly for that operation and never stored.

Connection strings are encrypted with AES-256-GCM as soon as you save them, bound to your account, and never shown again. You can replace them at any time.

As encrypted files in object storage (Cloudflare R2). Only encrypted data is ever written there, and each file's checksum is recorded so any change is detected.

Own-key backups can't be decrypted without it, by anyone. That's the point of own-key mode, and Backup Safe asks you to confirm it before you turn it on. You can reset own-key mode so that your future backups are protected again, but backups made with the lost passphrase stay unreadable.

PostgreSQL 13 to 18, self-hosted or managed (AWS RDS, DigitalOcean, Supabase, Neon and others), as long as the database accepts connections from Backup Safe's IP address. Backup Safe uses the PostgreSQL tools matching your server's version.

After every upload, Backup Safe downloads the stored file again, checks its checksum, decrypts every block and reads the whole archive with PostgreSQL's restore tool. Only a backup that passes all of that is marked verified.

No, and we're precise about this. Every backup gets the integrity check above. The restore test runs once a day per database, on its newest verified backup: it's restored into an isolated sandbox, compared object by object with the original, then deleted.

The dashboard always shows which backup was restore-tested and when. A newer backup is never shown as tested until it has been.

Restore tests run in a sealed sandbox with strict time, memory and disk limits, so they can never affect anything else. Backups larger than 5 GB are integrity-verified on every upload but not restore-tested, and they're clearly marked as such.

A backup reads your data, so it adds read load while it runs. Normal reads and writes carry on; only schema changes (like ALTER TABLE) wait until it finishes. Choose a quiet hour for daily backups; hourly backups run at a fixed minute of each hour.

For backups, a read-only user is enough (on PostgreSQL 14+: GRANT pg_read_all_data). Restores need a user that can create and drop tables in the target database, such as its owner.

It restores a backup into the original database or another one you've added, like a staging copy. Objects in the backup are replaced; objects not in the backup are left alone. The backup is authenticated first and the restore runs as one transaction: it completes fully or changes nothing. Tables being restored are locked while it runs, so pick a quiet moment.

Yes. Download any backup as a standard PostgreSQL dump and restore it with pg_restore. For own-key backups you can also keep the encrypted file and your recovery kit: a single-file offline tool decrypts them on any computer, with no connection to Backup Safe.

7 days with every feature, up to 2 databases and 5 GB of storage. A card is required at checkout; you're charged when the trial ends unless you cancel. One trial per account.

You're warned at 80% and 95%. At the limit, new backups pause and you're told clearly by email and in the dashboard. Nothing is deleted early. Upgrade, or delete older backups you don't need; your newest verified backup of each database can never be deleted by accident.

Scheduled backups stop and your backups are kept for 14 days, with an email right away, after a week and one day before deletion. You can download or restore them throughout, or reactivate to keep everything.