Profile Settings

Theme

Connections Backups Restore

Monitoring Analytics API Keys Audit Log

Billing Settings

Need help? Documentation

Connections

Manage database connections, schedules and backup health from one place.

AES-256 Encrypted Verified Auto Backup

Connect your first database

Start protecting your database with automated, encrypted backups in just a few minutes.

Connect Add your database
Secure Backup Encrypted automatically
Restore Anytime Recover when needed

Supported databases

PostgreSQL
Supabase
Neon
Railway

Encrypted backups Secure credential storage Restore-ready

Add database connection

Name

Provider

Environment

Connection string

Sent once over TLS, encrypted at rest, and never shown again.

Backup schedule

Run at (local time)

Timezone

This is a read replica

Encryption

Every connection string is encrypted at rest today using platform-managed AES-256. Bring your own key (real, AWS KMS, available on Pro and Max) is attached from Edit after this connection is created — generating the IAM trust/permissions policy and registering a role ARN needs a real connection id to scope them to, the same reason SSH Tunnel's key pair is configured from Edit too.

Platform-managed (AES-256)

Storage destination

Where encrypted backups are stored. Bring your own storage (real, S3-compatible: AWS S3, Backblaze B2, Wasabi, or a custom endpoint) is configured from Edit after this connection is created -- same reasoning as SSH Tunnel's Generate Key Pair and BYOK's IAM policy flow above: a bucket/role setup needs a real connection id to attach to.

Cloudflare R2 (default)

SSH Tunnel / Bastion Host

Connect through a bastion host for databases that aren't publicly reachable. After creating this connection, open Edit to generate a key pair and test the tunnel.

Enable SSH tunnel for this connection

Bastion Host

Bastion Port

Bastion Username

Command Center

Edit connection settings

Name

Environment

Region

Backup schedule

Run at (local time)

Timezone

Connection Information

Connection ID
Provider
Created

SSH Tunnel / Bastion Host

Enable SSH tunnel for this connection

Bastion Host

Bastion Port

Bastion Username

No key pair generated yet.

Public Key

Add this to ~/.ssh/authorized_keys on your bastion host.

Read-Replica Awareness

This is a read replica

A replica is read-only, so restoring a backup onto it will always be blocked. Click Test Connection to verify this claim against the database itself -- we never trust the checkbox on its own.

Bring Your Own Key (BYOK)

Bring Your Own Key (BYOK)

Encrypt this connection's backups with a key only you control (AWS KMS), instead of DBBackup's platform key.

Available on Pro and Max — Upgrade →

Encrypt this connection's backups with a key only you control, instead of DBBackup's platform key. If you revoke our role's trust policy or disable/delete your key, we permanently lose the ability to restore backups encrypted with it -- this is by design.

Your plan no longer includes BYOK configuration changes -- upgrade to Pro or Max to reconfigure. Your existing setup keeps encrypting new backups, and you can still test or disable it below.

Key management provider

Your CMK ARN

BYOK is not configured for this connection yet.

In your own AWS account, create an IAM role using this trust policy, then attach this permissions policy to it. The trust policy only lets our account assume the role, and only when it presents this exact external ID -- it cannot be assumed by anyone else.

External ID

Trust policy

Permissions policy

Scoped to exactly kms:Encrypt, kms:Decrypt, kms:GenerateDataKey and kms:DescribeKey on this one CMK -- never kms:* or Resource: *.

Role ARN (from the role you just created)

Bring Your Own Storage (BYOS)

Store this connection's encrypted backups in your own bucket instead of DBBackup's platform storage. Backups already stored on the platform are not migrated automatically -- enabling this only changes where future backups for this connection go.

Storage provider

Bucket name

Region

Endpoint URL (optional)

Leave blank for AWS S3. Required for Backblaze B2, Wasabi, and every other S3-compatible provider.

Authentication method

Access key ID Secret access key

BYOS is not configured for this connection yet.

In your own AWS account, create an IAM role using this trust policy, then attach this permissions policy to it -- the SAME cross-account role-assumption pattern as BYOK above, scoped to S3 actions on this one bucket instead of KMS actions on a CMK.

External ID

Trust policy

Permissions policy

Scoped to exactly s3:GetObject, s3:PutObject, s3:DeleteObject, and s3:ListBucket on this one bucket -- never s3:* or Resource: *.

Role ARN (from the role you just created)

Rotate Backup Key

Generates a new key version for this connection's FUTURE backups only -- every existing backup keeps decrypting normally, and this does not touch SSH Tunnel, BYOK, or BYOS credentials. Does not re-encrypt your stored connection string -- to rotate the key protecting that, use Settings → Security's "Rotate encryption key".

Regenerate SSH Key Pair

Generates a new SSH key pair for this connection's tunnel, replacing the existing one.

Connection Security

Point-in-Time Recovery

Point-in-Time Recovery

Continuously capture every change to this connection so you can restore to an exact point in time, not just your last backup.

Available on Pro and Max — Upgrade →

Continuously captures every change to this connection so you can restore to an exact point in time, not just the last backup. Enabling starts a baseline snapshot backup immediately.

Enable Point-in-Time Recovery

View Allowed IPs Coming soon

Part of the upcoming Static Egress IP Allowlist feature.

Security Settings

Additional per-connection security controls. Each toggle saves immediately.

Require typing this connection's name before restoring FROM it

Adds an extra type-to-confirm step whenever a backup FROM this connection is restored into another connection -- in addition to the existing target-name confirmation.

Alert me about security-sensitive changes on this connection

Covers key rotation, SSH key regeneration, and BYOK/BYOS/Security Settings changes. Delivered through your existing Health Monitoring email/webhook channels (Settings → Notifications) -- not a separate channel.

Diagnostic Report

Runs the same reachability, credentials, and permissions checks as Test Connection.

Export Configuration

Downloads this connection's non-secret settings as a JSON file -- provider, name, environment, schedule, region, SSH tunnel host/port/username, BYOK/BYOS settings. Never includes the connection string, SSH private key, or any BYOK/BYOS credentials.

Import Configuration

Pre-fills the General tab from a previously-exported file. You'll still need to review and Save, then supply the connection string, SSH private key, and any BYOK/BYOS credentials by hand -- those are never exported or imported.

Delete connection

Are you sure you want to delete this connection?

Type to confirm

Can't delete this connection

View Restore History

Delete connections

Are you sure you want to delete these connections?

Pause connection

Are you sure you want to pause this connection?

Import from Supabase

Loading your Supabase projects…

No Supabase projects found on this account.

Your Supabase connection needs to be reconnected.

Supabase Integration

Database connectivity proves DBBackup can reach PostgreSQL. Supabase Management API verification separately proves which Supabase project owns this connection.

Loading integration status...

Provider: Supabase
Management API
Selected Project
Project Ref
Connection Attestation
Last Verified
Advanced Recovery Identity

Select Project

Backup History

No backups yet.

Estimated Recovery Time

What "Total Backup Time" includes

The full time from when a backup is triggered until it's safely stored — not just the database dump itself:

Connection setup and validation (SSRF-safe host resolution, or SSH tunnel setup)
A quick compatibility pre-check against the target database
The database dump itself
The encrypted upload to storage

For a small database, the dump and upload are themselves near-instant — most of the time is the sequence of setup steps beforehand, which is real time you wait through before your backup is safe.

Backup Stage Breakdown

Connection Details

Health Report

Tags

Connection Guide

Understand every status and metric on this connection.