Last updated: September 24, 2026
Security Architecture
Engineered to safeguard your critical database infrastructure with enterprise-grade protection.
1. Credential & Secrets Encryption
Every registered database connection string is symmetrically encrypted using AES-256-GCM with master keys managed via environment variables or secret managers (AWS KMS, HashiCorp Vault). Decryption keys are never transmitted to client browsers.
2. Isolated PostgreSQL 16+ Control Plane
The control database runs on a strictly typed TypeORM schema with runtime Joi validations. User authorization enforces strict separation between admin (connection and secret management) and operator (dump execution and telemetry observation).
3. Distributed Scheduler Locks
For multi-worker deployment topologies, the scheduler_locks table enforces mutual exclusion at the database level. No backup task can execute concurrently across multiple worker instances, preventing I/O spikes on production databases.
4. Cryptographic Dump Integrity
Each completed backup stream generates an immutable SHA-256 checksum during streaming. When executing restores, the dump file is verified against this checksum prior to applying any statements to target databases.