Encryption and security

FlashBackup is designed so that your data never passes through FlashBackup, and only you can read your backups.

Where your data goes

1. The agent on your server creates the backup.
2. It compresses and encrypts it on your server, with a key that never leaves your server.
3. It uploads the encrypted file directly to your Google Drive.

FlashBackup's servers only receive information about the backups: names, sizes, times and error messages. They never receive the contents.

The encryption key

Every server gets its own random encryption key when the agent is installed. Backups are encrypted with AES-256-GCM, which also detects any tampering.

To see the key again at any time, run on the server:

sudo flashbackup-agent show-key

The key is stored in /etc/flashbackup/agent.json, readable only by the root user. Reinstalling or updating the agent keeps the same key.

How the agent connects

• The agent only makes outbound HTTPS connections. You don't open any ports or firewall rules.
• Each server has its own secret credential. Removing a server in the dashboard immediately blocks it.
• Install commands work once and expire after 24 hours.
• For Google Drive, the agent receives a one-time upload link for each file. It never holds your Google password or long-term Google access.
• Database passwords you add to the agent's config stay on your server. They are never sent to FlashBackup.

Google access

FlashBackup uses Google's drive.file permission: it can only see files it created. The Google access token is encrypted in FlashBackup's database. You can revoke it at any time from Settings or your Google Account.

Your account

• Passwords are stored with a strong one-way hash (scrypt).
• Sign-in attempts are rate-limited.
• Every important action (adding servers, changing settings, team changes) is recorded in an audit log.
• Use roles: give people Viewer access unless they really need to change things.