Secryn protects backup data using application-level encryption with secure key handling. Backups capture the complete system state and are available only to administrators.

What Gets Backed Up

Each backup includes projects, vaults (restricted and standard), secrets with full history, keys, certificates, access keys, permissions, users, roles, RBAC configuration, system settings, and all log types (audit, request, user, MCP). Snapshots are atomic and consistent.

Backup Protection

For every backup:

• Secryn uses application-level encryption with secure key handling to protect backup data at rest
• the backup workflow provides the key material required for restore
• backup key material should be stored in a secure external system as part of your recovery process

Manual Backups

Admins can create backups on demand. Each backup is immutable, timestamped, and validated with integrity checks. Multiple backups can coexist for point-in-time recovery.

Scheduled Backups

Automated backups support configurable frequency, execution time, and retention (keep last N backups or purge after N days). Retention rules run after each backup to prune older copies. Backup key material exposed during the workflow should be captured and stored through the same recovery process you use for manual backups.

Restore Behavior

Restoring a backup fully replaces the current database, restoring all projects, vaults, resources, users, and configuration as captured. Restores are destructive and require the backup file plus the corresponding backup key material.

Access Control & Auditing

• only admins can create, schedule, or restore backups
• all backup/restore actions are logged
• restore activity remains visible through Secryn's audit controls

Best Practices

• store backup key material securely outside Secryn
• maintain multiple restore points
• test restores in non-production environments
• treat backup files and keys as highly sensitive assets

Backups in Secryn support long-term reliability and disaster recovery within Secryn's broader security model of application-level encryption, RBAC, audit logs, HTTPS in transit, and self-hosted control.