BACKUP OPERATIONS
Destinations
Flexible storage. One uncompromising encryption boundary.
Sample snapshotNov 6, 2026 · 8:30 PM CST
On-site engineAES-256 envelope encryptionOpaque ciphertext storage
Local USB / NAS
Fast local recovery without using hypervisor internal disks.
- Harbor main · NAS · sample available
- Harbor north · USB · sample available
- Lakeview HQ · NAS · sample available
Offsite ByOS
Windows Server and QNAP store ciphertext, never plaintext or decryption keys.
- Harbor main · QNAP · one copy delayed
- Harbor north · Windows Server · sample available
- Lakeview HQ · QNAP · engine offline
Optional cloud
An additional storage tier, not a prerequisite for local or offsite restores.
- Optional · not configured
- Provider integration is future work
- Same encrypt-at-source boundary
Pairing does not grant decryption
Mutual TLS identifies transport peers.
The engine and ByOS destination will pair through trusted mTLS enrollment. A pairing identity can transport ciphertext; it cannot decrypt a backup or request a restore unwrap.
QNAP remains dumb ciphertext storage, not key-aware software. Vexitey holds per-site wrapping keys in Azure Key Vault.
Note
This fictional workspace is not paired. Filesystem/HTTP storage adapters and controlled one-time enrollment require explicit configuration. Without a bootstrap, pairing returns 501. Caller certificate headers are never trusted.