SafeGrd vs Barman
Barman, maintained by EDB, is a backup server for PostgreSQL: one host pulls physical base backups and streams WAL from many clusters, with point-in-time recovery and a retention policy for each. SafeGrd runs on the host beside each database, takes logical backups of PostgreSQL and more, and restores them on a schedule to test them.
| Feature | SafeGrd | Barman |
|---|---|---|
| Scheduled restore tests | Yes | No |
| Tables and row counts checked after restore | Yes | Files checked against the manifest |
| Console, alerts and a status badge | Yes | No |
| Encrypted before upload | Yes | Opt-in GPG, from 3.14 |
| Every backup written under Object Lock | Yes | The bucket's default lock applies |
| Each backup uploads only what changed | Yes | Yes |
| Restore one table into a running database | Yes | No |
| Restores into a newer PostgreSQL major version | Yes | No |
| MySQL, MongoDB, SQLite, files, mailboxes, WordPress sites and Laravel apps | Yes | No |
| Signed record you can verify offline | Yes | No |
| A locked snapshot before an AI agent’s destructive command | Yes | No |
| One server backing up many clusters | No | Yes |
| Point-in-time recovery | Self-hosted PostgreSQL and SQLite | Yes |
| Price | $15/mo | Free, GPL 3.0 |
Barman is the better fit when you run many large PostgreSQL clusters and want one backup server for all of them, with physical backups that restore a whole cluster and WAL streamed to it continuously. Running both works: SafeGrd needs only a read-only role and can read from a replica (Databases), which gives you a tested logical copy, with the schema's roles, owners and grants, next to Barman's physical one.
Why teams add SafeGrd
barman verify-backuprunspg_verifybackup, which checks the backup's files against its manifest and that the WAL it needs is there. It does not restore, and PostgreSQL's own documentation says to test restores as well. SafeGrd restores the newest backup and counts every row (Restore and Fire Drills).- A logical copy loads into an empty database on any server, a newer major version
included (tested from 14 to 18). One table loads into a
database that is running, with
restore --table. - Every backup is written under compliance-mode Object Lock with its own date, and the
host's key cannot delete unless you turn on expiry. With
barman-cloudthe bucket's default retention locks what it uploads, andbarman-cloud-backup-delete --check-object-lockskips what is still locked. - There is no backup server to run: the console, the alerts and the drill record are run for you.
Barman details come from its documentation (version 3.19) and release notes.
Sources
- Barman: Barman for the cloud
- Barman: Backups, block-level incremental backups from 3.11
- Barman: Release notes, GPG encryption from 3.14
- barman verify-backup and pg_verifybackup
- Barman on GitHub (GPL 3.0)