Backups and Restore

Backups in Secryn export the instance state so you can restore it. Backup archives are encrypted with AES-256-GCM.

Backups are available under Admin -> Backups.

What Is Included in a Backup

Each backup is a full instance snapshot and includes:

• All projects
• All vaults (including restricted vaults)
• All secrets (including version history)
• All keys
• All certificates
• All users and roles
• RBAC configuration
• App settings and configuration

Backups are not partial and cannot be scoped to individual projects.

Backup Protection

Backup archives are encrypted with AES-256-GCM.

Important

• A manual backup generates a 256-bit key and shows it once. Each scheduled backup uses its own key. You can use a passphrase instead. Secryn derives that AES key with PBKDF2-HMAC-SHA256 (310,000 iterations).
• The generated key stays available from Recent Operations for about 24 hours. Record it before it disappears.
• Store the backup key or passphrase outside Secryn, separate from the backup file.
• Inside the encrypted archive, private-key files are stored as plain PEM/OpenSSH data. Secryn unwraps their SECRYN-PRIVATE-V1 envelopes at backup time, so the backup key or passphrase is what protects them, and on restore they are sealed again with the restoring instance's APP_KEY. Secret values in the database dump stay encrypted with the original APP_KEY. So does any private-key envelope Secryn could not decrypt when the backup was taken. To restore, you need the backup file, its key or passphrase, and the original APP_KEY (or the same key listed in APP_PREVIOUS_KEYS) for secret values. Treat the backup key or passphrase as sensitive as your private keys themselves: anyone who has it and the backup file can read every private key in it.

See the security model.

Creating a Manual Backup

To create a backup manually:

• Go to Admin -> Backups
• Click Create Backup
• Wait for the process to complete
• Download the backup file
• Record and securely store any backup key material shown by the workflow

After completion, the backup will appear in the backup history table.

Scheduled Backups

Secryn supports automated scheduled backups.

You can configure:

• Enable schedule
• Frequency (e.g., daily)
• Run time
• Keep last N backups
• Purge backups older than X days

Retention Policy

Retention rules are evaluated after each scheduled run.

Backups exceeding:

• The maximum number of retained backups, or
• The maximum age threshold

are automatically purged.

Backup Keys for Scheduled Backups

Scheduled backups also require backup key material during restore.

After a scheduled backup completes:

• Open Recent Operations
• Locate the backup entry
• Click View Key
• Store the key securely

Verify the key is stored in your recovery system before treating that backup as restorable.

Downloading Backups

Backups can be downloaded directly from the Backups page.

The downloaded file:

• Is an AES-256-GCM archive
• Requires the corresponding backup key or passphrase during restore
• Contains the database dump and the on-disk key and certificate files

Restoring from Backup

Restoring a backup replaces the entire instance.

Restore Requirements

You must provide:

• The backup file
• The corresponding backup key or passphrase
• The original APP_KEY, or the same key listed in APP_PREVIOUS_KEYS, to read secret values

Private keys from the archive are sealed again with this instance's APP_KEY during restore.

Restore Behavior

• The current instance data is fully replaced
• All existing projects, vaults, secrets, keys, certificates, users, and settings are overwritten
• The system state will match exactly what existed at the time of backup

Restore is not a merge operation.

Security Considerations

Because restore replaces the entire instance:

• Ensure you are restoring into the correct environment
• Verify the backup source
• Confirm the backup key material before proceeding

If possible:

• Perform restore operations during maintenance windows
• Notify users before initiating restore

Disaster Recovery Best Practices

For production environments:

• Enable scheduled backups
• Store backup key material in a secure external system
• Test restore procedures in a staging environment
• Periodically verify backup integrity

Avoid storing backup files and backup key material together.

Compliance & Audit

Backups support:

• Business continuity planning
• Disaster recovery strategy
• Regulatory compliance requirements
• Long-term archival retention

Backup creation and restore actions are recorded in Audit Logs.