# Backups and restore

> Daily encrypted backups, who holds the decryption key, the self-held recovery kit and restoring when a node is rebuilt.

Your node backs itself up every day, encrypted before the data leaves the machine. You decide who holds the key that can decrypt those backups. Backup settings are in the **Backups** section of the **Node** page.

## How backups work

- **When:** every day at 03:00 in the node's local time.
- **Encrypted on the node** before upload — the storage provider only ever sees encrypted files.
- **Stored in Cloudflare R2** with a **7-day deletion lock**, so a backup cannot be deleted during its first week, even by mistake.
- **Kept:** the newest **7 daily** and **4 weekly** backups. Manual backups and the backup taken before an upgrade count with the daily ones.
- **Tested:** every week the node downloads a backup, decrypts it, restores it locally and compares the counts. The page shows the last **restore drill** and whether it **Passed** or **Failed**.

The section also shows the last backup, the encryption, the key holder, the storage and recent results.

Owners and admins can choose **Back up now** — for example before a risky change. The result appears in the list when it finishes.

## Who holds the backup key?

**Who holds the backup recovery key?** has two answers:

| Choice | What it means |
|---|---|
| **Belvador vault (recommended)** | The key is sealed in the vault and used only to restore your workspace onto a new machine, with an audit entry. Belvador can recover your data for you. |
| **Me — recovery kit** | You download the key once. Belvador cannot restore your backups onto a new machine without it. If you lose it, those backups are gone. |

Only owners can change the key holder, and they confirm with their authenticator code.

### Creating a recovery kit

1. Choose **Me — recovery kit**, then **Create recovery kit**. The kit is created **in your browser**; only its public half is sent to Belvador.
2. **Download recovery kit** — a file headed *Belvador backup recovery kit*.
3. Store it offline and private: a password manager, an encrypted drive, a safe. Anyone with the file can decrypt this workspace's backups.
4. Tick **I saved the recovery kit somewhere safe, outside Belvador** and save.

> [!CAUTION]
> Belvador keeps no copy of a self-held kit. If you lose it, backups made with it cannot be restored onto a new machine. If you switch to a new kit, keep the old one until the backups made with it have expired (about 4 weeks).

## Restoring

Restoring happens when you replace a machine: **Replace machine & restore** on the Node page creates a new server and restores the latest successful backup onto it — see [Update, resize, rebuild and delete](https://belvador.dev/en/docs/node/updates#replace-machine-and-restore).

- With the **Belvador vault**, the restore runs on its own.
- With **your recovery kit**, the timeline asks you to upload the kit. Your browser reads it locally, checks that it matches, seals it for the new machine only and sends it, after you confirm with your authenticator code.

Errors received after the latest successful backup and not held at the edge are lost in a restore. There is no screen to pick an older backup or restore a single project.

## What you do not need

You never need Belvador's own keys, an operator's key, SSH access or R2 credentials to back up or restore. Each node gets temporary upload credentials limited to its own storage location.