Storage, retention and pruning

Append-only

Day to day, your server can add backups, and read them back, but it can’t delete or overwrite them. The storage refuses. So if someone gets root on your server, or a script goes wrong, the backups already stored stay where they are.

Each server has its own repository and its own storage login: one server can’t see or touch another’s backups.

Retention: how far back you can go

Each plan keeps this history by default (you can change it per server, see below):

The most recent backup is always kept. If you run extra backups with neverwiped backup now, they are kept until the next pruning, which keeps the last one of each day. Your plan’s storage is shared by its servers; when it is full, new backups fail but stored ones stay intact. This also happens after moving to a smaller plan than the space you use: the space goes down when the weekly pruning removes backups that leave the retention, or at once when you delete a server’s backups; moving back up applies at once. You get an email at 90 %.

Changing the retention of a server

In your dashboard, on the server’s page, Retention lets you choose, for that server only, how many daily and weekly backups are kept, inside your plan: at most what the plan keeps, and always at least the last 7 daily backups (the last 2 weekly ones on Essentiel). The most recent backup is always kept. You can also pause pruning: nothing is deleted and no login that can delete is issued for that server at all. Storage then only grows; when your plan’s storage is full, new backups fail.

A change takes effect according to what it would delete:

• Keeps at least as much (more daily or weekly backups, or pausing pruning): it applies at once.
• Would delete more (fewer backups kept, or resuming pruning): it waits 7 days. You get an email straight away, and you can cancel it from the server’s page until then. Before that date nothing more is deleted; after it, the next weekly pruning removes what the new setting no longer keeps.

So someone who got into your account can’t shorten the history and have it pruned before you hear about it. Your server can’t change the retention: the agent receives it from the platform with each maintenance login. If you move to a plan that keeps less, the retention of your servers is brought down to the new plan when it starts.

The pruning window

Deleting old backups needs the repository key, which only your server has. So pruning runs on your server, once a week, right after a backup (also after a backup refused because your storage is full: that is how the space goes down again):

1. The agent asks the platform for a maintenance login. The platform issues one only if pruning is due (about every 7 days).
2. That login can delete, only in this server’s repository, and it is valid for one hour.
3. The agent runs restic forget --prune with this server’s retention (your plan’s, unless you changed it), then the login expires. The repository is append-only again.

That hour is the only trade-off, and we say it plainly: someone with root on your server during that window could delete that server’s backups. Outside it, nobody can, from your server.

If the maintenance login can’t be issued (storage busy, platform unreachable), nothing is deleted and it is tried again at the next backup. The platform issues at most one maintenance login per server per week: if the prune itself fails once the login is issued, it waits for the next week, and asking again gets nothing. So even someone holding your server’s keys can’t keep the window open. If the platform ever sends an empty retention, the agent refuses to prune.

When backups are deleted for good

Stored backups are deleted only in these cases, always announced by email first:

• Trial ended without a plan: 7 days after the end of the trial.
• Cancellation: 30 days after the end of the last paid period.
• Unpaid subscription: on day 45 after the failed payment (new backups stop on day 10).
• You delete a server in your dashboard: that server’s backups, straight away.
• You delete your account (dashboard › My account): all of them, 7 days after your request. Until then nothing is deleted, backups go on, nothing is charged, and you can cancel on the same page. The email sent at the request says when; if you did not ask for it, cancel and change your password. Afterwards you get a deletion number. What we keep, and for how long (invoices 10 years, our own encrypted database backups at most 12 months), is on that page and in the retention policy.

Until then, restore keeps working, even while new backups are paused.