Skip to main content
The appliance produces a single encrypted, self-describing backup bundle you can restore onto a fresh appliance, a factory-reset appliance, or the same appliance in place. Backups are encrypted with age; the appliance only ever holds the public recipient, so a backup at rest can never be decrypted from the appliance alone.
A backup captures the durable state needed to reconstitute the deployment: the application database, the durable crypto (the master key and secret-box key that wrap your data-encryption keys), and appliance configuration. Ephemeral infrastructure secrets are regenerated on restore, which is what lets one bundle restore cleanly onto a different box.

​
What’s protected

  • Application database — tenants, org structure, rooms, file metadata, audit log, policies.
  • Durable key material — the master key and secret-box key (envelope-wrapped), so restored data remains decryptable with your KMS/keys.
  • Appliance configuration — the settings needed to bring the platform back up.
Encrypted file content lives in your configured object storage / KMS, not in the bundle — point the restored appliance at the same storage and KMS and it reconnects to your data.

​
Create a backup

Admin → Backup & Restore → Create backup. The bundle is produced on the appliance and listed for download.
The bundle is named enclave-backup-<timestamp>.tar.age. On a cluster, backups run on the primary (a replica reports that the primary’s schedule already covers it).

​
Schedule automatic backups

Admin → Backup & Restore → Schedule — enable and pick a cadence.

​
Verify a backup

Always confirm a backup is intact and restorable before you rely on it:
Admin → Backup & Restore → the backup’s Verify action.
Verification checks the bundle’s integrity and its manifest/version so a corrupt or incompatible archive fails loudly rather than at restore time.

​
Copy backups off-box

Keep copies off the appliance so a lost box doesn’t lose the backups. Configure an off-box target (SCP or a mounted directory) and test reachability:
Admin → Backup & Restore → configure the off-box destination, then Test the connection.
Store the age private key (identity) for your backups somewhere safe and off-box — a KMS, secrets manager, or sealed escrow. Without it a backup cannot be decrypted, and the appliance deliberately never keeps it.

​
Restore

Restoring overwrites the target appliance’s data with the backup’s contents, then reboots.
1

Start from a clean target

Deploy a fresh appliance (or factory-reset an existing one). Complete just enough of first-run to reach the admin UI.
2

Upload the backup + identity

Admin → Backup & Restore → Restore. Upload the .tar.age bundle and, when prompted, the age identity (private key) used to encrypt it. The identity is used only for this restore and is shredded immediately afterward — it is never stored at rest.
3

Confirm and reboot

Confirm the overwrite. The appliance restores the database + durable keys, regenerates ephemeral infrastructure secrets, and reboots. A pre-restore safety snapshot is taken first, so a mistaken restore is recoverable.
4

Reconnect storage and KMS

Point the restored appliance at the same object storage and KMS as the original so it reconnects to your encrypted file content and key material.
Console equivalent:
On a cluster, restore is a standalone operation. Restore onto a fresh single appliance and then re-form the cluster from it, or roll a node back to standalone first. Do not restore into a live cluster member — see High availability & clustering.

​
Recovery model at a glance

​
Next steps

Key Management

The KMS the restored appliance must reconnect to for file decryption.

Storage

The object storage that holds your encrypted file content.