Backup encryption keys and recovery kits

Every Outpost backup is encrypted on the endpoint with a key the endpoint generates. This page explains who holds a copy of that key, how to switch a client to zero-knowledge keys so Outpost holds none, and how to download the recovery kit that restores a backup without Outpost. Read it before the first backup runs, because the choice decides what you can recover after losing an endpoint.

How backup keys work

Each copy of each endpoint, primary or secondary, is a separate repository with its own key: 32 random bytes the endpoint creates when it first writes to the destination. Backups are encrypted with AES-256-GCM, in the format of the open-source kopia tool.

Every key exists in up to three places:

Where	Held by default	Held in zero-knowledge mode
On the endpoint, protected with DPAPI on Windows and in a file only root can read on Linux and macOS	Yes	Yes
In Outpost, sealed with the client’s own encryption key (escrow)	Yes	No
In a recovery kit you download and keep	When you download one	Only the kits offered when you turn zero-knowledge on

An endpoint does not write its first snapshot until Outpost confirms it has received the key, or, in zero-knowledge mode, confirms it will not keep one. Until then, runs show Skipped with waiting for Depot to hold the key.

Escrow or zero-knowledge

Zero-knowledge is set for a whole client, on Backup > Settings. It is not a profile setting, so no profile can override it.

What you can do	Escrow (default)	Zero-knowledge
Restore onto the source endpoint	Yes	Yes. The endpoint uses its own key.
Browse a snapshot’s files in the console	Yes	Yes, through the source endpoint while it is online
Download files as a zip in the browser	Yes	No
Restore onto another endpoint	Yes	No
Recover after the endpoint is lost or rebuilt	Yes. Outpost delivers the key to the endpoint that restores.	Only with a recovery kit
Download a recovery kit at any time	Yes	No

Zero-knowledge suits a client whose policy forbids a service provider from holding backup keys. It moves the job of keeping keys safe to whoever keeps the recovery kits.

Before you begin

• You need the backup:keys permission. Among the built-in roles, only the owner holds it. On the MSP plan, practice-level roles with storage:manage hold it too.
• You need a second factor on your console account. Outpost asks for it before changing key custody or downloading a kit.
• On the MSP plan, open the client’s workspace first. The setting belongs to one client.
• Decide where the recovery kits will be kept, such as a password manager or a safe. A kit holds a backup key in plain text.

Danger

Once zero-knowledge is on, Outpost cannot open the client’s backups and cannot replace a lost recovery kit. If an endpoint is lost, rebuilt, or reinstalled and nobody kept its recovery kit, its backups cannot be decrypted by anyone, including Outpost.

Turn on zero-knowledge

1. Go to Backup > Settings.
2. On the Zero-knowledge keys card, read the warning Depot will hold no backup keys.
3. Select Turn on zero-knowledge.
4. Confirm your second factor if Outpost asks for it.
5. Outpost makes a recovery kit for every repository from its own copy of the key, then deletes its copies. The Recovery kits card lists one kit for each repository, including earlier repositories a copy has moved away from, by endpoint id and copy. Select Download kit for each one.

Each kit link works once, for 15 minutes. Outpost cannot make the kits again, so download every one before you leave the page. If no endpoint had a key in Outpost’s keeping, the page says so instead, and each endpoint still holds its own key.

Caution

A repository created while zero-knowledge is on never has a key in Outpost. That includes every endpoint enrolled later, a secondary copy added later, and a copy that moves to another destination. The console cannot make a kit for it. To get kits for those repositories, turn zero-knowledge off, wait for the endpoints to connect and send their keys, then turn it on again and download the kits it offers.

Turn off zero-knowledge

1. Go to Backup > Settings.
2. Select Turn off zero-knowledge, and confirm your second factor if Outpost asks for it.

Outpost asks every endpoint to send its keys again. Endpoints that are offline send theirs when they next connect. Until an endpoint has sent its keys, browsing, downloads, and restores onto another endpoint still fail for its backups.

Download a recovery kit

With escrow, you can download a kit for any repository at any time.

1. Open the endpoint and select its Backups tab.
2. Under Recovery kit, select Primary kit (JSON) or Primary kit (PDF). If the endpoint has a secondary copy, the Secondary buttons download its kit.
3. Confirm your second factor if Outpost asks for it.

The kit is saved as recovery-kit-<hostname>-<copy>.json or .pdf. Every download, and every change to zero-knowledge mode, is recorded in the audit log.

In zero-knowledge mode, the download is refused with This client uses zero-knowledge backup keys, so Depot holds no key to put in a kit.

What a recovery kit contains

Field	Contents
Endpoint	The endpoint’s id and hostname, and whether this is the primary or secondary copy
Repository	The storage provider, endpoint URL, region, bucket, and prefix, or the network share path
Password	The repository’s key
kopia	The kopia version the repository was written with (0.23.0), and the commands to connect to the repository, list its snapshots, and restore one

The kit never contains credentials for the storage itself. To use it, you supply an access key that can read the bucket, or an account that can read the network share. For backups on Outpost Cloud Storage, you hold no credentials for the bucket, so a kit is a complete way out only for backups in storage you own.

Verify

• Backup > Settings shows Zero-knowledge is on for this client. with the time it changed, or off.
• On an endpoint’s Backups tab, each repository with no key in Outpost shows Zero-knowledge.
• Each kit you downloaded opens and names the expected endpoint and repository.

Next steps

• Restore files and systems
• Configure backups with policy
• Account security