How Rowsafe works
The agent, the hosted service and your bucket, and what each can do.
Three parts. Only the agent runs on your server.
| Part | Runs on | What it does |
|---|---|---|
Agent (rowsafe-agent) | your database server, or next to your database container | Backups, checks, Proof. Reports status and metrics. Open source. |
| Rowsafe service | our servers (api.rowsafe.sh, dashboard at app.rowsafe.sh) | Schedules, history, alerts, the dashboard, API and CLI. |
| Your bucket | your S3-compatible storage | The encrypted backups and change log. |
You use it through the dashboard, the CLI, the API or AI assistants over MCP.
The agent asks for work
The agent makes outbound HTTPS requests only. You open no port.
- Heartbeat every 30 seconds.
- Asks for a task every 5 seconds when idle.
- Sends metrics every minute.
It runs only this fixed list, one at a time, and never runs commands or SQL sent over the network. Marks have a fast lane, so they never wait behind a backup.
| Task | What it does |
|---|---|
inspect | Reads version, settings and sizes. |
adopt | Plans the changes backups need (read-only), or applies them. |
check | Proves changes reach your bucket. |
backup | Full, differential or incremental backup. |
drill | Proof: restores the latest backup on a scratch copy and checks it. |
restore_point | Sets a Mark. |
restart | Restarts PostgreSQL, only when someone clicks Restart and confirms, on a server where you allowed it. |
Your data and secrets stay with you
- Backups are encrypted on your server with a passphrase only you have.
- Bucket keys and passphrase live only on your server, readable only by the database's system user.
- The service stores metadata only: names, sizes, settings, task logs, metrics. Security model.
The life of a database
The installer takes a new database through these states:
registered you say yes you restart,
| (restart needed) Rowsafe notices
v | |
pending_adopt ----------+--> awaiting_restart ---+--> verifying --> active| State | Meaning | Backups scheduled |
|---|---|---|
pending_adopt | Registered. Only read-only plans have run. | No |
awaiting_restart | Settings applied; waiting for a PostgreSQL restart, which Rowsafe notices. | No |
verifying | Proving changes reach your bucket. If it fails, fix the cause and click Check now (or rowsafe verify). | No |
active | Backups and Proof run on schedule. | Yes |
No restart needed? It goes straight to verifying.
Schedules
Three schedules per database, in UTC, as 5-field cron:
| Schedule | Default | |
|---|---|---|
| Full backup | 0 1 * * 0 | Sundays at 01:00 |
| Differential backup | 0 1 * * 1-6 | Monday to Saturday at 01:00 |
| Proof (restore test) | 15 21 * * 0 | Sundays at 21:15 |
- They start when the database is
active. Missed runs aren't replayed. - A run still going means the next one is skipped.
- At most once an hour.
- Change them in the database's settings, or with
rowsafe set.
If the service is down
Your database keeps archiving to your bucket, so restore to any second still works. Scheduled backups, Proof and alerts pause until it's back.
PostgreSQL details