True today
- Our runner holds a key that can read your backups. It never holds your live credentials.
- Every week your system is rebuilt on a short-lived server in London, checked and destroyed.
- That server cannot reach the internet while it runs. An outbound fence is checked on every rehearsal.
- If your backup contains a credential file we look for, the drill fails and tells you.
- We keep your last proven copy and one before it. We delete everything the day you leave.
- The code opens in December.
- What this does not prove: data written after the backup, and email, payments and webhooks.
Planned, not yet built
Each line below goes on the list above the week it has worked for real.
- On the bad day you type your keys on our recover page. Your keys are sealed in your browser. Our service stores only the sealed copy. The runner opens it in memory for your job and deletes it after. The recover page shows the runner's key fingerprint, which we publish. Your keys are written once onto your rebuilt server, and we remove our own access. Change every credential you typed afterwards.
- If you connect hosting, storage or a platform, we hold a read-only key for it, encrypted on our own server, used once a week, and deleted the day you leave.
- If you choose to be rebuilt onto our account, that server is yours to keep and we bill it monthly.
- If you pay for history, we keep more proven copies. Every copy has an encrypted spare at a storage company that cannot read it.