Opsmate

Opsmate protects your data at rest

Opsmate encrypts all data, including metadata, using the industry-standard AES-256 before uploading it from your server. Unique AES keys (one for data and another for metadata) are generated for each backup, and are encrypted with your account's RSA public keys before being uploaded along with the backup. Only you, as the holder of your RSA private keys, can reverse this process and decrypt your data.

Additionally, all backups are signed with RSA to protect against tampering.

Opsmate follows best practices for all use of cryptography. For a detailed technical description, see the crypto details page.

You maintain full control over your private keys, and choose how they're managed.

Opsmate protects your data in transit

Opsmate requires HTTPS for our website, and our servers are configured to prefer strong, forward secrecy-preserving ciphers. We use HSTS to ensure browsers communicate with Opsmate only over HTTPS. We're included in Firefox and Chrome's HSTS preload list, and in the rulesets for HTTPS Everywhere.

All communication between the Opsmate client and the Opsmate servers is encrypted using TLS with strong, forward secrecy-preserving ciphers only. Although your data is encrypted with your personal encryption key before it is uploaded, it is encrypted again with the ephemeral TLS session key. This ensures that even if your key is compromised at a later date, it cannot be used to decrypt data that was sniffed while in transit.

The TLS connection between the Opsmate client and the Opsmate server is verified using an Opsmate-specific certificate authority which is bundled with the client. Using an Opsmate-specific certificate authority ensures that the Opsmate service remains secure even if the public certificate authority system is compromised.

Opsmate runs a secure infrastructure

Opsmate servers and development machines are secured to the highest degree possible. Servers run only stable operating systems with software that receives automatic nightly security updates. Public-facing services are kept to a minimum to reduce the attack surface.

Servers are configured using configuration management to ensure the uniformity of security-sensitive configuration. The configuration is frequently reviewed to ensure it's as secure as possible. Our configuration management repositiory is encrypted and signed to protect sensitive credentials and prevent unauthorized configuration changes.

All communication between servers, including database traffic, uses encrypted and authenticated VPNs. No sensitive communication ever leaves a server unencrypted.

All servers use encrypted swap to ensure sensitive memory cannot be recovered from disk. All systems used for development and administration use full-disk encryption to ensure the security of keys and credentials.