Sealed before upload
Products encrypt their own backup containers before sending them. KyRecovery stores those sealed bytes, without the recovery private key or any custodian share.
← All apps
Backups sealed.
KyRecovery / Backups & recovery
Backups sealed.
Recovery shared.
A home for encrypted backups that cannot open them. Your applications seal the data; your chosen custodians hold the shares needed to recover it.
Open source (MIT) · Self-hostedScreenshots
See it in use.
Inside KyRecovery
Store the backup.
Separate the keys.
Recovery by agreement
Choose how many custodian cards are needed to recover the data. For example, a three-of-five arrangement requires any three of five shares to open a backup.
Copies beyond one server
Replicate sealed containers to configured S3-compatible storage, SFTP, SMB or a local directory. Review the documented transport limitations and verify your offsite copies.
See every backup at a glance
The Backups tab shows each service’s newest capsule. With the optional restic overlay it also flags corrupt, missing, stale and never-backed-up services.
A guided restore plan
Pick a point in time and get the exact restore command to run. Custodian shares are never typed into the dashboard; the restore happens with the product’s tools.
Signed and monitorable
The container image is signed, so you can verify it before pinning. A public health endpoint lets KyPulse watch the server without exposing backup details.
From backup to recovery
Three distinct jobs.
- The product seals its backup to the suite’s public key
- KyRecovery stores the sealed container and records its digest
- Custodians supply enough shares to restore with the product’s tools
Know the limits before you rely on it.
- Integrity is not a restore test. KyRecovery can check that stored bytes still match their recorded digest. It cannot decrypt a container or prove that your application will restore successfully. Follow the product’s recovery runbook and test your recovery process.
- Recovery-key rotation is not yet implemented. Choose a threshold your custodians can actually meet. If too few shares remain available, the server cannot unlock the backups for you.
- A purge can remove a product’s last local backup. Review the expiry preview before manually purging. Offsite destinations need their own retention policies.
- Offsite transports have documented limitations. Verify your offsite copies rather than assuming replication succeeded.
For operators
Keep track of what you keep.
- Run the ceremony
- The recovery keypair is generated in the administrator’s browser. Print and distribute the custodian cards, then close the ceremony tab. Only the public key and threshold settings are sent to the server.
- Protect the cards
- Keep shares separately. Custodians, not the server, hold what is needed to open a backup.
- Pair with a short code
- An administrator generates a time-limited, single-use pairing code. The product receives the public recovery key and a deposit-only token: it cannot use that token to browse or download backups.
- Check stored copies
- On-demand checks and a daily integrity sweep compare containers with their recorded SHA-256 digests. A hash-chained audit ledger records deposits, verifications and administrative events.
- Control retention
- Keep recent backups plus weekly and monthly copies, and review the expiry preview before purging.
- Look after the store
- Back up the database, server secret key and capsule directory together. Deposits are capped at 384 MiB each, and the server does not reserve disk space, so plan capacity and monitor free space. The server secret key protects its own credentials; it does not unlock the sealed backups.
Part of your Ky setup
KyIdentity can provide dashboard sign-in; local administrator login is also available. Backup schedules belong to the connected products; KyRecovery plans a restore but does not run it. During pairing, compare recovery-key fingerprints or pin the public key by hand, following the product’s instructions.
KyRecovery still holds account information, backup metadata and audit records. “Blind store” refers to encrypted backup contents, not an absence of operational data. Operators are responsible for access and retention. Read the Busnes.app privacy policy.
Next step
Plan your way back.
Read the operating requirements, choose your custodians, and review the ceremony and restore instructions before pairing your first product.