The credential never leaves your network
Run our worker beside the database. It connects outbound to us, takes the schedule, does the work locally, and sends back an artifact that is already encrypted. We orchestrate. We never touch the database, and we could not if we wanted to.
No card required. USD 50 credit on every new workspace.
We could not store your credential if you asked us to
A local backup has no place to put a source payload. The API rejects one outright, and our database has no field that could hold it. The connection string lives in the worker's own config file on your machine, and that is the only copy in existence.
This matters because "we would never look" is a policy, and a policy survives exactly as long as the company that wrote it. A field that does not exist is a different kind of promise.
The whole custody split, on one screen
The database credential
yoursYour worker's config.yaml, on your machine. The API refuses it if you try to send it to us.
The connection details
yoursSame file. Host, port, database name and pg_dump options never reach our database either.
Your encryption private key
yoursYours alone. We hold the public half, which is enough to encrypt and useless for reading.
The schedule and the run history
oursOurs, because that is the part you wanted taken off your hands. Times, durations, outcomes.
The encrypted artifact
oursOurs, replicated and retained. Ciphertext we cannot open, which is the point.
Nothing of ours can reach into your network
The worker dials out and holds the connection open, the same shape as a CI runner or a monitoring agent. There is no port to open, no inbound rule to justify to whoever owns the firewall, and no address of yours written down on our side.
Ciphertext, and metadata about ciphertext
Encryption happens on your machine, before the upload starts. What we receive is a sealed file, its size, its checksum and when it was made. That is enough to store it, verify it and hand it back, and not enough to know what is in it.
You are running a process, and it has to stay running
This is the real trade, and it is the mirror of the managed path. There is a binary on a machine you own. Somebody has to install it, keep it upgraded, and notice if the machine it lives on is retired. A worker that quietly stops is a backup that quietly stops, and while we will show you that runs are missing, we cannot restart something we cannot reach.
If nobody on your team wants that job, the managed path takes it off you and asks for a credential in exchange. Pick the cost you would rather carry; both are honest.
Keep the credential. Hand over the schedule.
One binary, one config file, and the part that fails silently becomes someone else's problem.