Encryption Key Management

Backup data at rest is protected by your storage destination’s own encryption, not by a Breeze-managed cipher on the agent. Today that means S3 server-side encryption (SSE) — there is no agent-side encryption step, and no client-managed key is currently used to encrypt or decrypt any live backup.

---

What’s Actually Enforced

Encryption is a toggle on your storage configuration, and it’s only enforceable for Amazon S3 (or S3-compatible) destinations:

• SSE-S3 (AES-256) — set serverSideEncryption to AES256 in the provider config. S3 encrypts every object with an AWS-managed key.
• SSE-KMS — set serverSideEncryption to aws:kms and provide a kmsKeyId (or keyArn). S3 encrypts objects using your own KMS key.

If you enable encryption on a Local/NAS destination, or on S3 without a recognized serverSideEncryption value, Breeze rejects the configuration as unsupported — there is no client-side fallback cipher for those cases.

---

Encryption Keys Manager (Early Access)

Go to Backup > Device Backup > Encryption to see the key manager.

Caution

This page is early access and is not wired to any live backup data. Creating, rotating, or deactivating a key here does not encrypt, protect, or otherwise affect any actual backup or snapshot today — the agent has no encryption capability of its own to apply these keys to. It exists ahead of a planned client-side (envelope) encryption model.

The key list shows:

• Key name
• Key type (AES-256 or RSA-2048)
• Status: Active (green), Rotated (gray), or Deactivated (red)
• Created date
• Expiry date (if set)

1. Click Create New Key.
2. Enter a descriptive name (e.g., “Production AES Key 2026”).
3. Select the key type (AES-256 or RSA-2048).
4. Click Create.
5. The key’s fingerprint (SHA-256 hash) is displayed once, at creation time.

Keys can also be rotated (the old key moves to Rotated, a new one becomes Active) or deactivated. Rotation is manual only — there is no scheduled or automatic rotation.

---

How to Actually Protect Backup Data Today

• In transit — all backup data is transferred over HTTPS (TLS 1.2+)
• At rest — for S3 destinations, enable server-side encryption (SSE-S3 or SSE-KMS) on the storage configuration, as described above
• For Local/NAS destinations, rely on your own disk/volume-level encryption — Breeze does not encrypt data written to a local path