Skip to main content

Security

Security at lionbackup is spread across several layers: encryption of the content, separated zones, role-based access control, the central evaluation of security-relevant events and an anomaly detection you switch on per project.

Encryption​

The data to be backed up can be end-to-end encrypted client-side before it leaves the customer's system. The client-side keys remain exclusively with the customer — lionbackup receives this content only as ciphertext. In addition, the objects are stored server-side encrypted in the S3-compatible object storage. The transfer to the Citadels runs exclusively over HTTPS/TLS.

Details and notes on key handling can be found under Encryption.

Access control​

Each organization defines its own roles. They are enforced both in the portal and at the API level:

  • Owner — full control, including billing and member management.
  • Administrator — manages projects, tokens and members; no access to billing.
  • Write — may upload backups.
  • Read — may restore backups.
  • Billing — access exclusively to invoices and payments.

Sign-in is via single sign-on (Authentik) with multi-factor authentication (TOTP). For automated access, project-scoped access tokens are used.

Zone isolation​

The Storage Zones are network-separated from each other and from the Business Zone. Customer uploads go directly to the public endpoints of the Citadels and do not pass through the Business Zone. Only management and metadata are exchanged between the zones over encrypted, mutually authenticated connections.

Immutable, write-protected storage (WORN)​

For projects configured accordingly, the principle WORN — "Write Once, Read Never" applies: objects are stored immutably within the retention period (object lock) and can neither be changed nor deleted. At the same time an upload or write token cannot read existing backups — restoring requires a separate token with read permission (role Read). Writing and reading are thus strictly separated; a compromised write token can neither download nor delete existing backups. See Lifecycle of a backup.

Anomaly detection​

Security-relevant events of the Citadels are evaluated centrally for all projects. Among other things, this recognizes the use of tokens outside the intended project and an unusually large number of downloads in a short time. Such notices appear in the portal and can optionally be delivered by email.

You switch on the anomaly detection for your backups per project in the portal. From the first backups it learns the project's rhythm and then reports unusual backup sizes, durations and file counts as well as missing or extra backups. It reports unencrypted or malformed archives (low entropy, damaged archive structure) from the first backup on. Anomalies appear as a message in the portal. Read more under Citadels.