SafeGrd: PostgreSQL backups that are restored and checked on a schedule

SafeGrd is a new backup service for PostgreSQL 13 and later that restores every backup on a schedule and checks the row counts.

It takes a backup, restores it later into memory or a throwaway database, and counts what came back, so you find out a backup is broken before you need it.

Taking the backup

The safegrd daemon runs on a host next to your database and connects as a read-only role. On PostgreSQL 14 and later that role only needs pg_read_all_data. On 13 you grant each schema instead. The schema comes from pg_dump and the rows come over binary COPY, in one transaction. After the first run, each backup uploads only what changed.

The backup is encrypted with age on your host before it leaves, then written to an S3 bucket with Object Lock on. That can be your own bucket or SafeGrd-hosted storage. The backup data never goes through SafeGrd's servers.

You choose how the age key is managed. With a customer-managed key, only you can decrypt these backups. With a SafeGrd-managed key, SafeGrd keeps your key sealed and releases it only to your enrolled hosts, so you can restore even after losing a host.

Supabase, Neon and Amazon RDS work from a connection string. Supabase backups are restored on Supabase's own Postgres image, so the extensions in the dump load.

Testing the backup

We call the restore test a Fire Drill. It takes the newest backup, decrypts it and checks it in one of two ways:

• In memory. The dump is replayed without a running server, and the table, row and column counts and the extensions are compared with what the backup recorded.
• In a sandbox. The backup is restored into a throwaway PostgreSQL database and the counts are checked there. You can add your own SQL checks too, for example SELECT count(*) FROM users WHERE email IS NULL has to return 0.

Each drill writes a signed, dated record with the counts and the check results. Every record points at the one before it. The attestation verifier checks the whole chain against SafeGrd's published signing key in your browser, with nothing to install.

Trying it

curl -fsSL https://safegrd.dev/install.sh | sh
safegrd login
safegrd enroll

The CLI source is on GitHub under the Business Source License 1.1.

The free plan covers one database. It is backed up daily to SafeGrd-hosted storage, or hourly to your own bucket, and drilled in memory once a week. Paid plans start at $15 a month and add hourly backups, sandbox drills and more databases.

Docs: safegrd.dev/docs