Why Encrypted Backups Matter More Than You Think

You back up your database. Good. But have you thought about how those backups are stored?

Most backup solutions — including many popular ones — store your data in plaintext on remote servers. That means anyone with access to those servers can read your data: the backup provider's employees, a hacker who breaches their infrastructure, or a government with a subpoena.

For applications that handle user data, financial records, or health information, this is a serious liability.

The Problem with Traditional Backups

Traditional backup services work like this:

Your server exports the database

The raw SQL dump is uploaded to the backup provider

The provider stores it on their servers (maybe encrypted with their key)

Step 3 is where the problem lies. Even if the provider encrypts data at rest, they hold the encryption key. This means they can decrypt and access your data at any time. It's security theater — you're trusting a third party with your most sensitive data.

Zero-Knowledge Architecture

Calm Backup takes a fundamentally different approach. With zero-knowledge encryption:

Your server exports the database

The backup is encrypted on your server with a key only you possess

The encrypted blob is uploaded to Calm Backup's storage

We never see your encryption key. We never see your raw data. Even our own engineers cannot read your backups. If a court ordered us to hand over your data, all we could provide is an encrypted file that's useless without your key.

How the Encryption Works

Calm Backup uses AES-256-GCM — the same encryption standard used by banks and governments. Here's what happens during a backup:

Your database is exported to a temporary file

The file is encrypted using your local key with AES-256-GCM

A checksum is generated for integrity verification

The encrypted file is uploaded over TLS

The temporary plaintext file is securely deleted

The encryption key is generated during setup and stored in your environment file. It never leaves your server.

What About Restoring?

Restoring is just as effortless as backing up. When you run the restore command, Calm Backup automatically downloads the encrypted backup, decrypts it using your local key, and imports it into your database — all in a single step. The entire process is handled for you; decryption and import happen seamlessly on your machine without any manual intervention. Your plaintext data is never exposed to any external service.

vendor/bin/calmbackup restore

That's it — one command and your database is restored. No manual downloads, no separate decryption step, no fiddling with keys.

Compliance Benefits

Zero-knowledge encryption helps with regulatory compliance:

GDPR — Your EU users' data is encrypted before crossing any boundary

HIPAA — Health data remains encrypted at all times outside your server

SOC 2 — Demonstrates strong data protection controls

PCI DSS — Cardholder data is never stored in plaintext by third parties

Don't Settle for Plaintext Backups

Your database contains your users' trust. Protect it with encryption that actually works — encryption where you hold the key, not your backup provider.

Calm Backup makes zero-knowledge backups easy. Three commands to set up, automatic daily backups, and the peace of mind that your data is truly private.