PostgreSQL 13–17 Client-side age encryption S3 Object Lock

An agent can destroy every row, file and message you own.It cannot touch a vault it has no key to.

One pipeline for the three surfaces an agent can wipe: your database, your files, your email. SafeGrd captures the surface, encrypts it on your machine to a public key you hold the other half of, and writes the ciphertext into WORM storage that nothing—not your agent, not your root credentials, not us—can overwrite before its retention expires. Then it restores that snapshot on a schedule, so “we have backups” stops being a hypothesis.

All three ship together. One keypair, one WORM policy, one attestation chain across every surface — because on any single one of them, you have cheaper options than us.

Start 14-day trial See how it works
brew install safegrd/tap/safegrd && safegrd init
Apache-2.0 CLI No credit card for the trial Bring your own bucket
SafeGrd Snapshot Readout — 01
Node
node-prod-01 — orders-eu
Snapshot
snap-20260919-094520
Pipeline
COPY → zstd → age X25519
Size
1.94 GB → 441 MB (4.4×)
Digest
3f9a e1 77 … c7d1
WORM until
2026-10-19 compliance mode
Threat Shield
No anomaly — delta within threshold
Rows captured 2,150,420
Tables captured 48
Fire Drill passed Restored in an ephemeral sandbox, 3.8s.
48/48 tables · 2,150,420/2,150,420 rows.
Verified19 SEP 2026
01 — SURFACES

Three things an agent can destroy. One vault it cannot reach.

The blast radius of an autonomous agent is not just your database. It holds the same credentials for your object storage and your mailbox. SafeGrd treats all three as one problem: capture, encrypt on your machine, lock, and prove by restoring.

POSTGRES DATABASE FILES OBJECT STORAGE EMAIL MAILBOX ENCRYPT AGE X25519 · YOUR KEY WORM VAULT OBJECT LOCK · COMPLIANCE FIRE DRILL VERIFIED

Postgres

At launch

Binary COPY straight off a read-only connection, compressed, encrypted, locked, and restored into a throwaway database on a schedule with every table and row asserted against the manifest.

PostgreSQL 13–17 · pgx v5

Files

At launch

Buckets and volumes an agent holds write credentials for. Same client-side encryption, same Object Lock, with the restore drill asserting object counts and digests rather than row counts.

S3 · GCS · R2 · volumes

Email

At launch

The mailbox that holds every password reset you own, and the one surface nobody backs up. Captured over IMAP, encrypted to the same key, locked under the same retention.

IMAP · Google Workspace

One custody boundary, not three products. The capture stage differs per surface; the custody model does not — the same age keypair, the same Object Lock policy, the same attestation chain. That combination is the whole argument, which is why none of it ships piecemeal. Everything here is buildable against the open-source CLI you can already read.

02 — PIPELINE

Four steps. Step three is why the other three survive.

Plenty of tools dump and plenty now verify. Almost none make the result undeletable — and a backup your agent’s credentials can still reach is not a backup, it is a second copy in the same blast radius. Every stage runs inside your infrastructure. The control plane schedules, watches and reports — it never receives a row of your data or a key that could read one.

01

Dump

A pure-Go dumper streams Postgres’ binary COPY wire protocol straight out of a read-only connection. No pg_dump binary required, no temp file on disk.

pgx v5 · native or toolchain
02

Encrypt

The stream is compressed with zstandard and encrypted to your age X25519 public key in one pass. Plaintext never lands on a disk or a wire.

age · X25519 · zstd
03

Lock

Ciphertext goes to your bucket under S3 Object Lock in compliance mode. For the retention window the object cannot be overwritten or deleted by anyone. Including you.

WORM · 14 / 30 / 90 days
04

Prove

On a schedule, a runner pulls the snapshot back, decrypts it, restores it into a throwaway database and counts every table and row against the manifest.

Signed certificate · public badge

Where the key lives, precisely. The Fire Drill runs in your environment, against your private key — it ships in the open-source CLI and you can read every line of it. SafeGrd’s servers receive the resulting report: table counts, row counts, timings, digests. They never receive the key, and they could not decrypt a snapshot if they wanted to.

03 — GUARANTEES

What holds when everything else has been compromised.

i

Your key never leaves

Backups are encrypted to a public key. The private half is generated by safegrd init on your machine and stays in your environment or your own KMS. A total breach of our infrastructure yields ciphertext and nothing else.

age X25519
ii

Deletion is not available

Object Lock in compliance mode is enforced by the storage layer, not by our code and not by an IAM policy someone can edit. A compromised root credential can start a delete; the bucket refuses it.

S3 · MinIO · R2 · Wasabi
iii

A backup is a hypothesis until it restores

Exit code 0 from a dump proves nothing about collations, missing extensions or a truncated upload. Every Fire Drill performs a real restore and asserts schema and row counts against the manifest before a snapshot is marked verified. Good open-source tooling now does this too — it is table stakes, and we would rather you ran something that restores than nothing. What verification alone cannot survive is the credential that deletes the verified copy.

Bi-weekly → daily
iv

Proof you can hand to a customer

Each verified node exposes a signed certificate and a live SVG badge for your README or status page — the thing a security questionnaire actually wants to see.

Verified 3h ago
04 — THREAT SHIELD

A bad migration is worse than an outage. It replicates.

When an agent truncates a table at 2am, the damage propagates on its own: the next backup faithfully captures the empty table, and retention quietly prunes the last good copy. The Threat Shield is what stands between those two events.

  • Every snapshot is diffed against the last one. Table count, per-table row volume, schema names, installed extensions.
  • A drop past the threshold freezes retention. The last known-good snapshot is locked against pruning before anything else happens.
  • The node is marked anomalous, not healthy. No green badge, no silent success in the dashboard.
  • Slack and Discord get paged immediately — with the snapshot ID that was frozen, so recovery starts from a known point.
05 — PRICING

Priced on proof, not on gigabytes.

Storing a backup is the commodity half — a cron job does it for free. What costs us money, and what nobody else can hand you, is the evidence that the thing restores. So that is the axis you buy on: how often we prove it, how long the record goes back, and whether you can export it to an auditor.

Every plan starts with a 14-day full-feature trial. A surface is one protected thing — a Postgres database, a bucket, or a mailbox. They count the same, because they cost us the same to prove. There is no free tier: storage-backed infrastructure abused for free helps nobody, least of all the people relying on it.

Starter
$39/ month

Pre-seed and solo founders with real users.

  • 3 surfaces, up to 20 GB each
  • Daily automated backups
  • 14-day WORM retention
  • Monthly Fire Drill restore
  • Postgres, object storage and mailbox surfaces
  • Slack & Discord alerts
Start trial
GrowthMost chosen
$119/ month

Seed to Series A teams shipping with agents.

  • 10 surfaces, up to 50 GB each
  • Backups every 6 hours
  • 30-day WORM retention
  • Weekly Fire Drill restore
  • Signed attestation history — every drill, append-only
  • Threat Shield poison-pill alarms
  • BYO-KMS (AWS / GCP)
Start trial
Scale
$349/ month

Teams answering security questionnaires.

  • 30 surfaces
  • Hourly backup schedules
  • 90-day WORM retention
  • Daily Fire Drill restore
  • Signed attestation history — every drill, append-only
  • Evidence Pack — exportable drill history, retention attestations and control mappings
  • Dedicated isolated runner sandbox
  • Priority emergency restore support
Start trial
Bring your own S3 / GCS — no storage surcharge Managed encrypted vault — $0.03 / GB / month The CLI is Apache-2.0 and works without an account
06 — BEGIN

The next destructive migration is already written. Be ready before it runs.

Five minutes to a first encrypted, locked, verified snapshot. You will not have to hand us a connection string to get there.

Start 14-day trial Read the pipeline