Your backups hold a full copy of your site, including its database. This article covers how Backvera keeps them safe: encryption, how Backvera talks to your site, where backups are stored, how they are checked, and the security controls your workspace has.
Encryption
- Every backup is encrypted before it is stored in the Backvera Cloud.
- Everything that moves between your site, Backvera and your storage travels over an encrypted connection.
- No decryption keys are kept on your host.
How Backvera talks to your site
Every request between Backvera and your site is signed with a secret that only the two of them share, and it expires within seconds. Each request can be used once. A copy captured on the way can’t be sent again, and a request that was changed after it was signed, even by one byte, is rejected.
Where your backups are stored
- Backups are stored in the Backvera Cloud, in the storage region you choose for each site: EU, US or Oceania. See Choose your backup storage region.
- If you choose the EU region, both the backups and the records that describe them stay in the EU.
- Your Backvera login is separate from your hosting account. If someone breaks into your host account, the copy in the Backvera Cloud stays out of their reach.
- On Business and Scale you can also keep a copy in storage you own, such as Amazon S3, an S3-compatible service, Google Drive, Dropbox or SFTP. On Scale you can keep copies in more than one cloud. See Mirror backups to your own storage.
How backups are checked
- Each part of a backup is checked against its checksum before it is accepted into storage.
- Each backup records a checksum of every file it contains.
- You can run a restore as a dry run first, to see what it would change before anything is written to your site. See Restore options: full, clone, and partial.
- We recommend testing a restore once a month into a staging site, on Business and Scale. See Spin up a staging site.
On the Security plans, Backvera also scans your backups for malware, for files that differ from the official WordPress releases, and for suspicious changes in the database. See Security scanning: how Backvera checks your backups.
GDPR and data handling
- Choose the EU storage region to keep a site’s backups in the EU.
- Export your data, or delete it, from the dashboard. You don’t need to open a support ticket. See Export your data, or delete your account.
- For what happens to backups after you delete a site or an account, see Data retention: what happens when you delete. Our Privacy Policy covers the rest.
Security controls for your workspace
- Single sign-on (SAML). Connect Okta, Microsoft Entra ID, Google Workspace or any SAML 2.0 identity provider. With SSO enforced, members can’t sign in with a password. See Set up SSO (SAML) for your workspace.
- Required two-factor authentication. Require 2FA for every member before they can open a backup or start a restore. A member without it is sent to set it up. See Require two-factor authentication for your workspace.
- Allowed email domains. Limit membership to domains you trust. Invites and sign-ups from other domains are refused. See Restrict who can join with allowed email domains.
- Audit log. Every login, restore and plan change is recorded with its time, the person who did it and their IP address. See Review the workspace audit log.
Still need help? Email our team at [email protected].