Security

Even if the SaintBackup server were compromised, an attacker could not read your data or issue commands to your Agents.

Machine identity

Each Agent and Center generates its own ECDSA P-256 (signing) and ECDH P-256 (key exchange) key pairs at install time. Private keys are stored encrypted with DPAPI on Windows, or with a machine key at permission 600 on Linux.

Every request is signed

The signature covers the method, path, timestamp and the SHA-256 of the body. The receiver only accepts paired machines whose clock differs by no more than 5 minutes.

End-to-end encryption

• Each backup is encrypted with AES-256-GCM using a key derived via ECDH between an ephemeral key and the Center's public key.
• Only the Center can decrypt. Even a compromised Agent machine cannot read back the backups it has already sent.
• Each 1 MB block carries an authentication tag; modified, truncated or reordered blocks are all detected.

Signed plans

The Agent only runs schedules and scopes signed by its paired Center, and never backs up databases outside the scope the Agent shares.

Interface

• The Agent and Center interfaces are only available on the machine itself by default.
• The Center requires a PIN; 5 wrong attempts lock it for 5 minutes.
• Externally exposed ports (8721, 8731) only serve signed API requests and do not expose the interface.

Secrets

Database passwords and Telegram tokens are encrypted on disk. The backup password is passed to mariabackup through a temporary file with restricted permissions, deleted right after the run — it never appears in the process list.