Whichever model you pick, every backup runs the same verified pipeline — scoped credentials, integrity checks, encryption, and retention-locked cold storage. The only thing that changes is where the dump runs.

Local worker

A lightweight worker runs inside your own infrastructure.

• Credentials stay local — nothing sensitive is sent to us.
• No need to expose your services — no incoming ports.
• Encrypted internally with your own key before it ever leaves.

Best when data residency matters or your source isn't reachable from the public internet.

Cloud worker

We operate the worker for sources reachable from our network, so there's nothing to deploy or host.

• Zero infrastructure to run or maintain.
• Best for managed or public-facing endpoints.
• Credentials stay sealed and scoped per job.

Manual push

Push any dump, file or stream yourself through the CLI, SDK or API:

saved backup run billing-db

Ideal for anything outside the 30 predefined integrations — and scriptable straight into CI. It flows through exactly the same verified pipeline as every other model.

Same guarantees, every path

| Step | What happens | | ------------- | ------------------------------------- | | Validate | Source and config checks | | Checksum | Integrity verified end to end | | Encrypt | AES-256 before storage | | Retain | Write-once, delete-locked cold storage |

Pick the model that fits your network — the security properties don't change.