Profile Settings

Theme

Connections Backups Restore

Monitoring Analytics API Keys Audit Log

Billing Settings

Need help? Documentation

Connections

Manage database connections, schedules and backup health from one place.

AES-256 Encrypted Verified Auto Backup

No Connections Yet

Connect your first PostgreSQL, Supabase, Neon, or Railway database to start automatic encrypted backups.

Learn More

Static Egress IP Allowlist Coming soon

Coming soon — static IPs will be published here so you can whitelist DBBackup's outbound traffic in your database's own firewall rules.

Add database connection

Name

Provider

Environment

Connection string

Sent once over TLS, encrypted at rest, and never shown again.

Backup schedule

Run at (local time)

Timezone

This is a read replica

Encryption

Every connection string is encrypted at rest today. Bringing your own key (real, AWS KMS) is configured from Edit after this connection is created — see connections.html's Edit modal for why: a key pair needs a real connection id to attach to, same reasoning as the SSH Tunnel section's Generate Key Pair.

Platform-managed (AES-256) Encrypted and stored by DBBackup. No setup required. Bring your own key (BYOK) Encrypt with a key only you control (AWS KMS) — set up from Edit after creating this connection.

Storage destination

Where encrypted backups are stored. Bring your own storage (real, S3-compatible: AWS S3, Backblaze B2, Wasabi, or a custom endpoint) is configured from Edit after this connection is created -- same reasoning as SSH Tunnel's Generate Key Pair and BYOK's IAM policy flow above: a bucket/role setup needs a real connection id to attach to.

Cloudflare R2 (default)

SSH Tunnel / Bastion Host

Connect through a bastion host for databases that aren't publicly reachable. After creating this connection, open Edit to generate a key pair and test the tunnel.

Enable SSH tunnel for this connection

Bastion Host

Bastion Port

Bastion Username

Command Center

Edit connection settings

Name

Environment

Region

Backup schedule

Run at (local time)

Timezone

SSH Tunnel / Bastion Host

Enable SSH tunnel for this connection

Bastion Host

Bastion Port

Bastion Username

No key pair generated yet.

Public Key

Add this to ~/.ssh/authorized_keys on your bastion host.

Read-Replica Awareness

This is a read replica

A replica is read-only, so restoring a backup onto it will always be blocked. Click Test Connection to verify this claim against the database itself -- we never trust the checkbox on its own.

Bring Your Own Key (BYOK)

Encrypt this connection's backups with a key only you control, instead of DBBackup's platform key. If you revoke our role's trust policy or disable/delete your key, we permanently lose the ability to restore backups encrypted with it -- this is by design.

Key management provider

Your CMK ARN

BYOK is not configured for this connection yet.

In your own AWS account, create an IAM role using this trust policy, then attach this permissions policy to it. The trust policy only lets our account assume the role, and only when it presents this exact external ID -- it cannot be assumed by anyone else.

External ID

Trust policy

Permissions policy

Scoped to exactly kms:Encrypt, kms:Decrypt, kms:GenerateDataKey and kms:DescribeKey on this one CMK -- never kms:* or Resource: *.

Role ARN (from the role you just created)

Bring Your Own Storage (BYOS)

Store this connection's encrypted backups in your own bucket instead of DBBackup's platform storage. Backups already stored on the platform are not migrated automatically -- enabling this only changes where future backups for this connection go.

Storage provider

Bucket name

Region

Endpoint URL (optional)

Leave blank for AWS S3. Required for Backblaze B2, Wasabi, and every other S3-compatible provider.

Authentication method

Access key ID Secret access key

BYOS is not configured for this connection yet.

In your own AWS account, create an IAM role using this trust policy, then attach this permissions policy to it -- the SAME cross-account role-assumption pattern as BYOK above, scoped to S3 actions on this one bucket instead of KMS actions on a CMK.

External ID

Trust policy

Permissions policy

Scoped to exactly s3:GetObject, s3:PutObject, s3:DeleteObject, and s3:ListBucket on this one bucket -- never s3:* or Resource: *.

Role ARN (from the role you just created)

Rotate Encryption Key

Generates a new key version for this connection's backup encryption. Only affects FUTURE backups -- every existing backup keeps decrypting normally, and this does not touch SSH Tunnel, BYOK, or BYOS credentials.

Regenerate SSH Key Pair

Generates a new SSH key pair for this connection's tunnel, replacing the existing one.

Point-in-Time Recovery

Point-in-Time Recovery

Continuously capture every change to this connection so you can restore to an exact point in time, not just your last backup.

Available on Pro and Max — Upgrade →

Continuously captures every change to this connection so you can restore to an exact point in time, not just the last backup. Enabling starts a baseline snapshot backup immediately.

Enable Point-in-Time Recovery

View Allowed IPs Coming soon

Part of the upcoming Static Egress IP Allowlist feature.

Security Settings

Additional per-connection security controls. Each toggle saves immediately.

Require typing this connection's name before restoring FROM it

Adds an extra type-to-confirm step whenever a backup FROM this connection is restored into another connection -- in addition to the existing target-name confirmation.

Alert me about security-sensitive changes on this connection

Covers key rotation, SSH key regeneration, and BYOK/BYOS/Security Settings changes. Delivered through your existing Health Monitoring email/webhook channels (Settings → Notifications) -- not a separate channel.

Diagnostic Report

Runs the same reachability, credentials, and permissions checks as Test Connection.

Export Configuration

Downloads this connection's non-secret settings as a JSON file -- provider, name, environment, schedule, region, SSH tunnel host/port/username, BYOK/BYOS settings. Never includes the connection string, SSH private key, or any BYOK/BYOS credentials.

Import Configuration

Pre-fills the General tab from a previously-exported file. You'll still need to review and Save, then supply the connection string, SSH private key, and any BYOK/BYOS credentials by hand -- those are never exported or imported.

Delete connection

Are you sure you want to delete this connection?

Delete connections

Are you sure you want to delete these connections?

Pause connection

Are you sure you want to pause this connection?

Import from Supabase

Loading your Supabase projects…

No Supabase projects found on this account.

Your Supabase connection needs to be reconnected.

Backup History

No backups yet.

Recovery Readiness

What "Total Backup Time" includes

The full time from when a backup is triggered until it's safely stored — not just the database dump itself:

Connection setup and validation (SSRF-safe host resolution, or SSH tunnel setup)
A quick compatibility pre-check against the target database
The database dump itself
The encrypted upload to storage

For a small database, the dump and upload are themselves near-instant — most of the time is the sequence of setup steps beforehand, which is real time you wait through before your backup is safe.

Backup Stage Breakdown

Connection Details