---
title: "Back up off the machine · Agent Wranglers"
url: https://agentwranglers.se/playbook/operations/disaster-recovery/off-site-backups
updated: 2026-10-20
licence: "All rights reserved"
---

# Back up off the machine

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Disaster recovery](https://agentwranglers.se/playbook/operations/disaster-recovery)
- Rule: Copy backups automatically to storage in another place, which an attacker on the server cannot delete.
- How: Use the database's own backup tool on a schedule, such as `pg_dump`, `mysqldump`, a snapshot or SQLite `VACUUM INTO`. Never copy a live database file with plain `cp`. Encrypt the copy and send it to another provider or region. Use a key that can only add files, and turn on versioning or an object lock, such as S3 Object Lock. An attacker who takes over the server must not be able to delete or change the backups. See [encrypted backups](https://agentwranglers.se/playbook/data/backups-and-recovery/encrypted-backups) and [restore tests](https://agentwranglers.se/playbook/data/backups-and-recovery/restore-tests).
- Check: The newest backup in the off-site store is younger than the recovery point objective, and the server's own keys cannot delete it.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers operations playbook: https://agentwranglers.se/playbook/operations/disaster-recovery/off-site-backups`.

- Previous: [Set recovery targets](https://agentwranglers.se/playbook/operations/disaster-recovery/recovery-targets)
- Next: [Write the restore runbook](https://agentwranglers.se/playbook/operations/disaster-recovery/restore-runbook)
- [Disaster recovery](https://agentwranglers.se/playbook/operations/disaster-recovery)