Skip to main content

Security

Security at lionbackup is spread across several layers: encryption of the content, separated zones, role-based access control and an automated anomaly detection.

Encryption​

The data to be backed up can be end-to-end encrypted client-side before it leaves the customer's system. The client-side keys remain exclusively with the customer — lionbackup receives this content only as ciphertext. In addition, the objects are stored server-side encrypted in the S3-compatible object storage. The transfer to the Citadels runs exclusively over HTTPS/TLS.

Details and notes on key handling can be found under Encryption.

Access control​

Each organization defines its own roles. They are enforced both in the portal and at the API level:

  • Owner — full control, including billing and member management.
  • Administrator — manages projects, tokens and members; no access to billing.
  • Write — may upload backups.
  • Read — may restore backups.
  • Billing — access exclusively to invoices and payments.

Sign-in is via single sign-on (Authentik) with multi-factor authentication (TOTP). For automated access, project-scoped access tokens are used.

Zone isolation​

The Storage Zones are network-separated from each other and from the Business Zone. Customer uploads go directly to the public endpoints of the Citadels and do not pass through the Business Zone. Only management and metadata are exchanged between the zones over encrypted, mutually authenticated connections.

Immutable, write-protected storage (WORN)​

For projects configured accordingly, the principle WORN — "Write Once, Read Never" applies: objects are stored immutably within the retention period (object lock) and can neither be changed nor deleted. At the same time an upload or write token cannot read existing backups — restoring requires a separate token with read permission (role Read). Writing and reading are thus strictly separated; a compromised write token can neither download nor delete existing backups. See Lifecycle of a backup.

Anomaly detection​

Security-relevant events of the Citadels are evaluated centrally. An automated anomaly detection recognizes, among other things, the use of tokens outside the intended project, indications of unencrypted uploads (low entropy) as well as statistical outliers in volume and throughput. Anomalies appear as a notice in the portal and can optionally be delivered by email.