Backup encryption

Backup encryption protects a node’s CDP Backup recovery points with a passphrase that only you know. The backups are encrypted with AES-256. Only someone with the passphrase can browse or restore them. Encryption is optional and off by default.

Use it when the node holds sensitive data or runs in production, or when your security policies require backups to be encrypted.

In Manage CDP Backups, an encrypted backup shows a shield beside the node’s name.

When you set the passphrase

You choose encryption only when you turn backup on:

• On an existing node, check Do you want to apply encryption? in Backup Schedule Configuration; see Turn on CDP Backup for a node.
• On a new node, check Do you want to apply backup encryption? under Enable Backup. on the create-node form; see Enable backups on a node.

Enter the passphrase in Encryption Passphrase and again in Confirm Passphrase. It must be 8 to 50 characters, with at least one digit, one uppercase letter, one lowercase letter, and one special character.

When you need the passphrase

Every backup of the node is encrypted with the passphrase. To browse or restore an encrypted backup, enter the passphrase in Passphrase and click Submit. A wrong passphrase gets “Passphrase provided is incorrect. Please provide correct passphrase to proceed.” Once you enter the right one, you can browse and restore the backup.

If you lose the passphrase

If you lose the passphrase, neither you nor E2E can restore the node’s backups. E2E does not store your passphrase and cannot reset or recover it.

Every later backup of the node uses the same passphrase, and needs it to be restored too. Those old recovery points need the lost passphrase, so turning backup off loses nothing you could restore. To back the node up with a passphrase you know, turn backup off and on again with a new one.

Keep the passphrase in a password manager, and share it only with the people who restore backups. Choose a passphrase you do not use anywhere else.

Changing encryption later

Encryption and the passphrase stay as you set them for as long as backup is on. Change Schedule has no setting for either.

Turning backup off removes the node’s recovery points for good. Restore anything you need first. Then, to add encryption, remove it, or change the passphrase, turn backup off and on again with the new setting. See Deactivate CDP Backup.

What encryption covers

Encryption protects the recovery points stored on E2E’s backup servers, not the files on the running node. To encrypt a volume, choose encryption when you create it; see Encrypt a volume.