The append-only vault

Offsite storage your servers can write to but never delete from, so a stolen key or a compromised server can't erase your backups.

How the vault works

The credentials your servers use can add new backups but cannot delete or overwrite existing ones. Pruning old backups happens only on the vault side. Retention is time-based (for example, keep everything from the last 90 days), as restic recommends for append-only repositories: a count-based policy like "keep three weekly snapshots" could be gamed by an attacker adding fake snapshots so the real ones get pruned. Details on the restic page. If an attacker takes over your server, they cannot destroy your history in the vault.

• Encryption happens on your side before upload. We never hold your key, so if you lose it, nobody can recover the data. Keep it somewhere safe.
• Regions: a single region, or dual for a second independent copy.
• Retention changes that shorten history take effect after a delay, so a compromised dashboard login cannot wipe backups instantly.
• Billing is per TB stored, measured daily.

Using the vault with restic

export RESTIC_REPOSITORY=rest:https://{user}:{token}@vault.servatum.io/{repo}
export RESTIC_PASSWORD_FILE=/root/.restic-pass

restic init                      # once
restic backup /home /etc /var/lib/mysql-dumps
restic snapshots                 # list restore points
restic restore latest --target /restore

restic forget and prune are refused from your side by design. Every backup into the vault appears in Proof automatically, with no extra setup.