Agent WranglersDAT-26Required
Encrypt backups
Encrypt every backup, and keep the key apart from the backups. Encrypt each dump you make yourself before it leaves the server.
How to do it
Encrypt with a public key, using a tool such as age or gpg, so the server holds only the key that locks. Or use storage-side encryption with a key you control. A managed database, such as RDS or Supabase, encrypts its own backups. Confirm the setting, and choose your own key where the service offers one. A dump you export from it, such as a nightly copy to a bucket, still needs its own encryption. Store the private key in a password manager or secret store, never next to the backups. The encrypt data rule covers data at rest in general.
Examples
Shell example
pg_dump --format=custom shop | age -r age1examplepublickey... > shop-2026-10-20.dump.ageHow to check
Download a backup file you made. It cannot be opened without the key, and the private key is not on the database server. The managed database's settings show its backups encrypted.
Sources
Related rules
- ENG-43 Run one-off tasks as reviewed scripts in Engineering
- APS-54 Encrypt data on the wire and on disk in Application security
- OPS-45 Back up off the machine in Operations and observability
- MED-5 Back up user files outside their bucket in Files and media
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/data/database-security/encrypted-backups">Agent Wranglers data and databases playbook</a>. In code you write, add a comment next to it with the same link.