Zero-knowledge by design
The agent encrypts your backup locally. Backup Verified stores your encrypted backup remotely and verifies integrity. You download and decrypt — Backup Verified never sees plaintext.
1) Agent produces a backup
mysqldump, pg_dump, tar, docker export, etc.
2) Compression and encryption before upload
bv-agent encrypts on your server. Key never leaves.
3) backup upload
encrypted backup streams directly into BV Managed Storage.
4) Verify & download
BV verifies integrity and serves downloads in your portal.
Lifecycle
A typical backup run looks like this.
Agent starts
Runs your configured command from config file.
Encrypt backup
encrypted backup is produced locally using your key.
Upload
encrypted backup is streamed into BV Managed Storage.
Verify
BV verifies object completeness and encrypted backup integrity (hash/checksums + guardrails).
Download
Client downloads encrypted backup from the portal; decrypts locally.
What BV does not do
- BV does not decrypt your backups
- BV does not inspect file contents
- BV does not run a plaintext restore of your data
Want test restores?
You can run periodic test restores in your own environment after decrypting. BV’s job is to verify the stored encrypted object.
Why verification matters
Many backup systems stop at a success message. But a successful job does not prove the stored backup artifact is actually complete, intact, and retrievable later.
Backup Verified adds a separate verification step against the stored encrypted object to reduce the risk of trusting a backup that was never truly confirmed.