Backup and encryption

Reference for the Settings page’s Backup and Restore actions, and what each does and does not include.

The appliance’s Settings Admin tab provides two related actions: a full encrypted Backup, and a Restore from that backup.

Backup

Downloads a complete, encrypted copy of the appliance’s storage as a single file. It’s the appliance’s disaster-recovery copy, ready to restore onto the same appliance if something goes wrong.

Take a Backup before any risky change (an upgrade, a bulk migration, a restore rehearsal) and on whatever schedule your recovery objectives call for. Because nothing is redacted, treat the file as sensitive: store it securely and keep it within your organisation.

Configuration, secrets, private keys, credentials, and any PII in stored records are all included. logs and system_metrics are excluded, since both are ephemeral and regenerate at runtime rather than being part of the appliance’s durable state. The file is encrypted.

Restore

Uploads a previously downloaded backup file and replaces the appliance’s storage with it. This is how you actually use a Backup: turning that stored copy back into a running appliance after data loss, a bad change, or a planned rehearsal.

Only restore onto the same appliance the backup came from; a cross-domain restore is rejected outright (see below). Confirm you have the right file first, since restoring replaces whatever the appliance currently holds.

  1. The upload is validated synchronously, before any storage is touched and before a restart is even scheduled. It must have been taken from this same appliance. The restore is rejected outright, with no change to storage, if the backup is cross-domain (taken from a different appliance), plaintext (not properly encrypted), malformed, oversized, an expansion bomb, or fails to decrypt.
  2. Once validated, the uploaded backup is staged, then the appliance restarts to complete the restore.
  3. On startup, the same validation runs again, then the backup replaces the appliance’s current storage. If replacing it fails, the appliance puts its previous storage back.

Restoring replaces whatever is stored on the appliance. A backup doesn’t include the appliance’s logs or system metrics, so a restore also clears the current ones.

  • Settings: Where the Backup and Restore actions live, alongside the appliance’s other administrative actions.
  • Secrets: Credentials that are included in a full Backup.
  • Governance records: Signed records that a full Backup includes.