Security
A backup product holds a copy of everything you care about. This page says how that copy is protected, what choices you make, and where the protection stops.
Where your data lives
On your server, in your office, on a disk you own. BackupMate has no cloud service. We never receive your files, your file names, your computers' names or your encryption keys, and we have no way to obtain them.
Encryption
Each PC encrypts its files with AES-256 before sending them, using a passphrase you choose when you connect it. What arrives at the server is already encrypted, and the connection it travels over is encrypted again with TLS.
BackupMate uses Kopia, a widely used open-source backup engine, for storage and encryption. We did not write our own cryptography.
Who holds the key: your choice
| You hold the key (default) | The server holds a copy | |
|---|---|---|
| Who can read the backups | Only someone with the passphrase | Also the server's administrator |
| Passphrase forgotten | The backups cannot be opened by anyone, including us | The administrator can still recover the files |
| The PC is lost or dead | Possible only with the passphrase | Recover from the server directly |
| Suits | Personal machines; maximum privacy | Company-owned machines, where the files belong to the business |
With the default, a lost passphrase means lost backups. That is what makes it private, and nobody can undo it. Keep the passphrase in a password manager, or choose the second mode.
Only your PCs can connect
The server runs its own private certificate authority. Adding a PC issues it a certificate, using a one-time code that you create in the server's console. From then on the server and the PC prove who they are to each other on every connection, and anything without a certificate is refused, including for the stored backups.
Ransomware and deleted backups
The usual way a backup is lost to ransomware is that the infected PC is allowed to delete it. In BackupMate, nothing a PC deletes or overwrites on the server is gone at once. It is moved to a recycle bin that only the server controls, and kept for 30 days. If backups go missing, an administrator puts back everything deleted in the last so many hours with one button.
This protects the backups against a compromised PC. It does not protect them against someone who takes control of the server itself. For that, keep a second copy of the server's storage somewhere the server cannot reach: a disk you swap weekly, or another machine.
What BackupMate sends over the internet
One thing, and you can switch it off.
Once a day the server fetches a small public file from this website to learn the latest version number, so that it can tell you when an update exists. That request carries nothing about you: no server ID, no licence, no count or names of computers, not even the version you are running. It downloads and installs nothing. The setting is under Settings → Support in the server's console.
The PCs never contact the internet. There is no telemetry, no usage reporting and no licence check that phones home; a licence is verified by the server on its own.
Diagnostics
When you ask us for help, you can export a diagnostics file from the console and send it to us. It contains the version, the log, the settings and the names of the folders being backed up. It does not contain passwords, encryption keys, enrolment codes or the contents of any file. It is sent only if you send it.
What is recorded
Recovering someone's files, deleting a machine's backups, changing who may connect, switching the update check: each is written to the Windows Event Log on the server with the administrator's name and the time.
Limits you should know
- One office, one building. Fire, flood or theft that takes the server takes the backups, unless you keep a second copy elsewhere.
- The server is trusted. Anyone with administrator access to the server machine can stop the service or remove its disk. Treat it like the safe it is.
- Every enrolled PC can reach the shared storage. PCs back up into one shared store, which is what lets identical files be stored once. Encryption and the recycle bin are what protect one PC's data from another, not separate storage.
- The installers are not yet code-signed. Check the published SHA-256 on the download page until they are.
- Do not expose it to the internet. BackupMate is built for a private network. Do not forward its ports through your router.
Reporting a security problem
Write to pranay@buzzneuron.com with "Security" in the subject. Please give us a reasonable time to fix a problem before making it public. We reply to every report.