Encrypted Cloud Backups (R2 / S3)

Pocket Kit includes a built-in Cloud Backup Vault that lets you back up your databases directly into your own storage buckets.

---

Supported Storage Providers

• Cloudflare R2 (Zero egress fees)
• Amazon Web Services (AWS S3)
• MinIO & Self-Hosted S3-Compatible Storage

---

Backup Pipeline Flow

flowchart LR
    subgraph LocalTenant ["Local Tenant Instance"]
        DB[("pb_data/data.db")]
        Storage["pb_data/storage/"]
        Hooks["pb_hooks/ & migrations"]
        Zip["Compressed .ZIP Archive"]
        DB --> Zip
        Storage --> Zip
        Hooks --> Zip
    end

    subgraph SecurityVault ["Pocket Kit Vault"]
        AES["AES-256 Encrypted S3 Credentials"]
        Uploader["Multi-part Stream Uploader"]
        AES --> Uploader
    end

    subgraph CloudDestinations ["Target Cloud Destination"]
        R2["Cloudflare R2 (Zero Egress)"]
        S3["Amazon AWS S3"]
        MinIO["MinIO / S3-Compatible"]
    end

    Zip --> Uploader
    Uploader --> R2
    Uploader --> S3
    Uploader --> MinIO

---

How to Configure Cloud Backups

1. Open the R2/S3 button on any instance card.
2. Click + Add Storage Destination.
3. Select your provider, bucket name, region, endpoint URL, and credentials (Access Key ID & Secret Access Key).
4. All credentials stored in Pocket Kit are encrypted at rest using AES-256-GCM.
5. Click Push Snapshot Now to trigger an automated export.