Cybee - Notre faq - FAQ | Frequently Asked Questions - Are backups deduplicated?

Are backups deduplicated?

Yes. Data is encrypted at the source using AES-256 before being sent, protected in transit by TLS, and Cybee never has access to its plaintext content.

Yes, and at every stage of their lifecycle. Encryption is a core principle of Cybee: a customer’s data never leaves their systems in plain text.

Encryption at the source, before any transmission

Data is encrypted directly on the server or protected workstation by the Cybee Agent using AES-256 encryption in authenticated mode with integrity checking. This encryption occurs before any transmission to the backup space: data is transmitted and stored exclusively in encrypted form.

Encryption in Transit

In addition to encryption at the source, data flows between the Agent and the backup storage space are protected by the TLS protocol (version 1.2 minimum; TLS 1.3 preferred). Data thus benefits from dual protection during transfer.

Key Management that xxcludes any access by Cybee

Encryption is based on a two-tier architecture, unique to each backup repository:

  • A master key, unique to each repository, encrypts and authenticates all the data it contains;
  • One or more access keys, each derived from a distinct passphrase via a memory-intensive derivation function, are used to unlock this master key.

The passphrases are stored in a dedicated technical vault, whose mechanisms prevent Cybee staff from accessing the plaintext passphrases. The keys are injected into the Agent only when backups and restores are performed: encryption and decryption operations take place exclusively on the customer’s systems. Cybee therefore has no plaintext access to the content of the backed-up data.

This centralized management offers a concrete advantage: the customer is relieved of the responsibility of key custody, which eliminates the risk of key loss—one of the most common causes of unrecoverable backups.

Transparent and Auditable Encryption

These mechanisms are not a “black box”: they are based on the open-source Restic engine, whose encryption format is publicly documented and proven. At the end of the contract, the decryption keys are returned to the customer, who can then use their backups without any dependence on Cybee.

To learn more: