Nothing to host, and one thing to weigh
Give us a connection and a schedule, and the first artifact exists minutes later. No machine to provision, no worker to keep alive. This is also the only path where we hold a credential to your data, and that is worth deciding on rather than clicking past.
No card required. USD 50 credit on every new workspace.
You hand over a credential. Here is what that buys and costs
What it buys
- No machine to provision, patch or keep running
- The fastest path from signing up to a working backup
- We notice a run that did not happen, because we own the schedule
- Identical artifacts: same encryption, retention and restore path
What it costs
- We hold a source credential. It lives in a secrets manager, is never a persisted field in our application database, and is released only to the run that needs it. That reduces the exposure. It does not remove it.
- Your source must be reachable from the internet. A database behind a VPN or with no public route cannot be connected to.
- Scripts, files and folders are unavailable here. Running arbitrary customer code in our cloud is a sandboxing problem we are not taking on.
We still cannot read what we store
This is the part people assume they are giving up, and they are not. Even here the artifact is encrypted to your public key before it is stored, so the bytes we hold are no more readable to us on this path than on any other. What changes is the credential, not the encryption boundary.
The top step, and you can stop lower
If you can run a worker, run a worker: it gets you the schedule without the credential. This step is the right one when hosting nothing is worth more to you than holding that credential yourself, which for a small team it often is.
Four things we do with the credential
It goes to a secrets manager
The whole payload, connection facts and credentials together, is written to a secrets store rather than to our application database.
Our database keeps the type and nothing else
Not the host, not the port, not the database name. The trade is deliberate: after a refresh the dashboard cannot re-display a connection, so you re-enter it.
It is read at run time only
The worker fetches it when a run starts. It is not held in memory between runs and not cached anywhere durable.
It runs on a separate plane
Backups we execute are driven by a different orchestration cluster from the one customer workers join, so the two failure domains are not shared.
The only shape that bills real computation
The run happens on hardware we pay for, so this is the one path where the computation meter does meaningful work. It is still dominated by archive at any realistic retention, and computation is priced per run-minute, so a job that finishes in twenty seconds is charged for twenty seconds.
What you need
- A source reachable from the public internet
- A credential you are willing for us to hold
- A GPG public key uploaded to the workspace
No machine, no agent, no network change on your side. That is the entire point of this path.