Skip to main content

Encryption

Encryption at lionbackup is two-stage: client-side, before data leaves your system, and server-side in the object storage.

Client-side end-to-end encryption​

The data to be backed up can be end-to-end encrypted client-side before it leaves the customer's system. The lionbackup client does this: it compresses and encrypts the data locally and afterwards transfers only ciphertext.

The client-side keys remain exclusively with the customer. lionbackup receives the content solely as ciphertext and cannot decrypt it.

Asymmetric method​

Asymmetric methods make it possible to encrypt backups for a recipient without that recipient holding the same secret key. In practice this means: you can back up using a public key, while the corresponding private key — the one needed to decrypt — is kept separately.

Server-side encryption​

In addition, the objects are stored server-side encrypted in the S3-compatible object storage of the respective Storage Zone. The transfer to the Citadels runs exclusively over HTTPS/TLS.

Loss of keys​

Keep keys safe

Because the client-side keys reside exclusively with you, lionbackup cannot restore the affected backups if those keys are lost. That is precisely the essence of end-to-end encryption.

Recommendations:

  • Keep key material in a secrets manager or a suitable key store.
  • Maintain a secured backup of the key material — separate from the backed-up data.
  • Keep custody of the private key organizationally separate from that of the access token.
Concrete algorithms

The algorithms and key lengths in use are documented in the technical security concept. This page describes the method at a functional level.