Trust & evidence
Verifiable, not vouched for
The platform’s security model in plain language: what is immutable, where data lives, and how destruction is proven.
Recovery point manifestVerified
rp-2026-08-05T02:00:14Z-9f42c81a
Capture completed02:00:14
Integrity digest matchsha-256 ✓
Boot verification14s to login ✓
Immutability lockrenews daily ✓
Signed • ed25519inspectable by your client
Immutability
Immutability by default
Recovery points carry rolling locks that renew daily. Suspension for non-payment never shortens existing immutability; a commercial failure must not become a data-loss event.
Residency
Residency as a boundary
Each organization chooses its storage location from your allowed set; a residency preflight confirms the region before the first capture.
Destruction
Certified destruction
When retention ends and destruction runs, a signed certificate is issued, and it outlives the data it certifies.
Identity
Read-only by design
Backups run under a consented read-only identity; writes exist only during restores, just-in-time, and revoke themselves.