Your data, your keys.
Encrypted with your key
A plan before any change
No surprise restarts
Nothing listens
Signed, tested updates
Private restore tests
Open-source agent
The details
If Rowsafe were compromised
It could
- Queue Rowsafe's fixed tasks: backups, checks, Marks, fixes.
- Read metadata: names, sizes, settings, metrics, task logs.
- Restart, rewind or update, only on servers that allowed it.
- Unless your servers pin their peers: pair a server of its own as a standby or fork target, which gets backup access.
- Offer a signed but bad release. Agents test it and roll back.
It could not
- Run arbitrary commands or SQL on your server.
- Read your rows or backups directly, or reach your bucket.
- Make an agent run an unsigned build, or downgrade it.
- Restart where you didn't allow it (except to fence an old primary).
Where every secret lives
| Secret | Held by | Grants |
|---|---|---|
API key (rsk_) | You, the CLI, the dashboard | The API for one organization. Can be read-only. |
Enrollment token (rse_) | The installer, once | Enrolling one host. Single use, short-lived. |
Agent token (rsa_) | /var/lib/rowsafe/agent.json on the host (0600) | The agent API for that host. |
| Bucket key and secret | /etc/rowsafe on the host (0600) | Your bucket. Never sent to Rowsafe. |
| Encryption passphrase | The host and your secret manager | Decrypting backups. Never sent to Rowsafe. |
| Release signing key | The release process, never the control plane | Agent builds that agents accept. |
How the agent runs on your server
- An unprivileged systemd user with no capabilities. It refuses to run as root.
- Outbound HTTPS only. It listens on nothing.
- A fixed set of tasks. It never runs commands or SQL sent to it.
- Connects to the database from the server itself only.
- Updates: Ed25519-signed, never downgraded, self-tested, rolled back if they fail.
- Proof restores into a private copy with no network listener, then deletes it.
- Tokens are stored only as SHA-256 hashes.