Security, in plain words
This page describes what Backora actually does, in the words we would use across a desk. Where something is not done, it says so.
Encrypted on your computer
Every file is cut into pieces, compressed and encrypted with AES-256-GCM on your computer before anything is uploaded. The server stores sealed pieces and cannot open them.
One key per computer, no key in the app
Each computer gets its own key, kept in Windows Credential Manager or the macOS Keychain. It is wrapped by a key for your business, which is wrapped by a master key that never leaves the server. There is no shared key inside the app for anyone to extract.
Verified before it is called Protected
After each backup, the server checks the list of files and every piece it refers to. Your dashboard says Protected only after that check passes, and shows when it passed.
The app can never delete a backup
The app's credentials can only write new pieces and read its own. Nothing an infected computer does can remove your earlier backups. Old restore points are removed only by our retention job after your plan's history period, with a further seven-day grace.
Restore to a replacement computer
If a computer is lost, install on the new one and sign in. The server hands the new computer a sealed copy of the old key for that restore only, and records the hand-over.
Account safety
Passwords are hashed with PBKDF2 and never stored. Repeated wrong attempts lock the account for a short time. Every request is rate-limited.
What our staff can see
Support staff see your business name, computer names, backup times and sizes. They never see file names or contents; the admin tools do not have that view.
What we do not claim
- We do not detect ransomware. We make sure an attack cannot delete your history, and that you can restore from before it.
- Verification checks the stored pieces; it is not a full test restore. Use Restore whenever you want to see your files come back.
- Backups run when your computer is on and connected. A computer that is off is not backing up, and the dashboard says so.
Engineers can read the technical description in our documentation.