Backups and restore

Your node backs itself up every day, encrypted before the data leaves the machine. You decide who holds the key that can decrypt those backups. Backup settings are in the Backups section of the Node page.

How backups work#

• When: every day at 03:00 in the node's local time.

• Encrypted on the node before upload — the storage provider only ever sees encrypted files.

• Stored in Cloudflare R2 with a 7-day deletion lock, so a backup cannot be deleted during its first week, even by mistake.

• Kept: the newest 7 daily and 4 weekly backups. Manual backups and the backup taken before an upgrade count with the daily ones.

• Tested: every week the node downloads a backup, decrypts it, restores it locally and compares the counts. The page shows the last restore drill and whether it Passed or Failed.

The section also shows the last backup, the encryption, the key holder, the storage and recent results.

Owners and admins can choose Back up now — for example before a risky change. The result appears in the list when it finishes.

Who holds the backup key?#

Who holds the backup recovery key? has two answers:

Only owners can change the key holder, and they confirm with their authenticator code.

Creating a recovery kit#

1. Choose Me — recovery kit, then Create recovery kit. The kit is created in your browser; only its public half is sent to Belvador.

2. Download recovery kit — a file headed Belvador backup recovery kit.

3. Store it offline and private: a password manager, an encrypted drive, a safe. Anyone with the file can decrypt this workspace's backups.

4. Tick I saved the recovery kit somewhere safe, outside Belvador and save.

Restoring#

Restoring happens when you replace a machine: Replace machine & restore on the Node page creates a new server and restores the latest successful backup onto it — see Update, resize, rebuild and delete.

• With the Belvador vault, the restore runs on its own.

• With your recovery kit, the timeline asks you to upload the kit. Your browser reads it locally, checks that it matches, seals it for the new machine only and sends it, after you confirm with your authenticator code.

Errors received after the latest successful backup and not held at the edge are lost in a restore. There is no screen to pick an older backup or restore a single project.

What you do not need#

You never need Belvador's own keys, an operator's key, SSH access or R2 credentials to back up or restore. Each node gets temporary upload credentials limited to its own storage location.