BACKUPS

Backups,
encrypted with your key.

Stream backups straight to S3, MinIO, Backblaze, R2, or any S3-compatible destination — encrypted client-side with a key only you hold. Cloudnan never sees plaintext data.

cloudnan.com / dashboard / backups

Backups & Snapshots

2 destinations · 47 snapshots · all encrypted client-side

cloudnan-prod-backups

s3.amazonaws.com / us-east-1

Encrypted (your key)24.8 GB

wasabi-cold-storage

s3.wasabisys.com / us-east-1

Encrypted (your key)156 GB

SnapshotSourceSizeCreated

app_prod-2026-05-09T03:00Zapp_prod / pg4.1 GB6 h ago
wp_db-2026-05-09T03:00Zwp_db / mysql380 MB6 h ago
web-01-snap-2026-05-08web-01 / volume12 GB1 d ago
app_prod-2026-05-08T03:00Zapp_prod / pg4.0 GB1 d ago

How it works

What happens under the hood.

01
Generate or paste your key
AES-256 key generated locally on the agent. Cloudnan never sees the plaintext key — only an audit-trail hash.
02
Wire your destination
S3 / MinIO / Backblaze B2 / Cloudflare R2 / Vultr / DO Spaces / Wasabi. Provide bucket + access key.
03
Schedule snapshots
Cron-style schedule per site / database. Retention policy per destination (e.g. 7 daily + 4 weekly + 12 monthly).
04
Encrypted streaming upload
tar | encrypt | upload — straight from the agent to the destination. Never lands plaintext in temp files.
05
Verify periodically
Cloudnan periodically download-and-decrypts a random recent backup to confirm the destination still works.
06
One-click restore
Pick a snapshot, the agent streams ciphertext back, decrypts on the box, replays. Audit-logged.

What you get

The capabilities that ship.

Customer-held keys

You hold the key. Cloudnan stores only a hash for audit. Lose the key — your backups are unrecoverable. (We document this prominently.)

7 destination types

S3, MinIO, Wasabi, Backblaze B2, Vultr Object Storage, Linode, Cloudflare R2. Plus DO Spaces, custom S3-compatible.

Per-site / per-DB schedules

Different retention policies for different workloads. Daily for prod, weekly for staging.

No double-encryption

When the source already encrypts (e.g. age-encrypted volumes), Cloudnan recognises and uploads ciphertext as-is.

Failure alerts

Backup failure goes to your notification channels. No silent missed snapshots.

FAQ

Common questions.

Is your encryption open-source?

Yes — the agent is open source (cloudnan-agent on GitHub). The encryption pipeline (AES-256-GCM, key never on control plane) is auditable line-by-line.

What about Cloudnan Storage?

We're shipping a managed storage tier for customers who don't want to manage their own S3. Optional opt-in, with the same client-side encryption model.

Related capabilities

Database Management

Backups integrate with the DB management surface.

Read

Drift Detection

Knows when a backup config drifts.

Read

AI Operations Assistant

Ask: "list backups from the last 7 days".

Read