Backup Encryption: Protect your data at rest

Backup encryption protects your sensitive data if a backup file is accidentally exposed, stolen, or lost in transit. Even when backups are stored securely, encryption adds a critical layer of protection by making the data unreadable without the encryption key.

Why encrypt backups?

Backups often contain:

• Database passwords and credentials
• Customer and user data
• Email accounts and messages
• Configuration files with API keys
• Business or personal information
• Payment processing details

If a backup file is accessed by someone without authorization, encryption prevents them from reading or using the data inside—even if they have the file itself.

Backup encryption methods

Backup encryption at UnderHost

On UnderHost shared hosting with cPanel and Backuply (our backup tool):

• Backups on server storage: Stored in restricted directories accessible only to your account. File system permissions protect access.
• Downloaded backups: You can optionally encrypt files before download using your control panel or command line tools.
• Automated remote backups: If you set up offsite backups, UnderHost supports encrypted uploads to compatible remote storage services.

On Cloud VPS and Dedicated Servers:

• You have full control over encryption. Tools like gpg, openssl, and tar with encryption are available via SSH.
• You can encrypt backups before storing them locally or uploading to remote storage.
• You can configure encrypted replication to backup servers or cloud storage.

Verify backup encryption

On shared hosting with Backuply:

1. Log in to cPanel → Backuply
2. Look for backup options or settings related to encryption
3. Check the backup summary to see if encryption is noted
4. If you have questions about specific backup encryption, contact UnderHost support

On VPS/Dedicated with command line:

To encrypt a backup file with GPG:

gpg --symmetric --cipher-algo AES256 backup.sql
# You'll be prompted to set a passphrase

To verify encryption worked:

file backup.sql.gpg
# Should show "gpg encrypted data"

To decrypt when you need the file:

gpg --decrypt backup.sql.gpg > backup.sql
# Enter the passphrase you set earlier

Best practices

• Always encrypt sensitive backups. Database backups containing user data should be encrypted both at rest and in transit.
• Use strong encryption algorithms. AES-256 is industry standard. Avoid weak or outdated encryption methods.
• Keep encryption keys secure and separate from backups. If your backup is encrypted but the key is in the same location, encryption is useless.
• Store backups in multiple locations with different access controls. One encrypted backup on-site, another encrypted backup offsite.
• Test encrypted backup restoration. Verify you can decrypt and restore from encrypted backups before you need them in an emergency.
• Use passphrase management. Store passphrases in a secure password manager, not in files or documents.
• Rotate encryption keys periodically. If a key may have been compromised, create new backups with a new key.
• Document your encryption setup. Future you (or your team) needs to know which backups are encrypted and how to decrypt them.

Your responsibilities

Encryption is one part of a security strategy. You are responsible for:

• Deciding which backups need encryption based on their content
• Implementing encryption if UnderHost does not provide it automatically
• Securing and backing up encryption keys
• Testing that encrypted backups can be restored
• Complying with regulations that may require encryption (HIPAA, PCI DSS, GDPR)

For regulated workloads (healthcare, payments, personal data), consult a qualified security professional or legal advisor to ensure your backup encryption meets compliance requirements.

Related: Backup best practices | Database backup | Secure your website

Related articles