Agent Wranglers

Backups and recovery Required

Encrypt backups

Encrypt every backup before it leaves the server, and keep the key apart from the backups.

By Erik Bergstedt, Agent Wranglers. Updated .

How to do it

Encrypt with a public key, using a tool such as age or gpg, so the server holds only the key that locks. Or use storage-side encryption with a key you control. Store the private key in a password manager or secret store, never next to the backups. The encrypt data rule covers data at rest in general.

Example

pg_dump --format=custom shop | age -r age1examplepublickey... > shop-2026-10-20.dump.age

How to check

Download a backup file. It cannot be opened without the key, and the private key is not on the database server.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers data playbook: https://agentwranglers.se/playbook/data/backups-and-recovery/encrypted-backups.