Cybee - Backup Security

Your backup security rests on several complementary layers of protection

Cybee is built on a defence-in-depth security architecture: the native mechanisms of the Restic engine, reinforced by S3 object storage properties, and complemented by Cybee’s own access control and identity layers.

No component is left unprotected.

Security Backup - 3 layers of security

Restic: a backup engine secure by design

Restic, the open-source engine at the heart of Cybee, natively integrates several security mechanisms that protect your data at every stage of its lifecycle.

End-to-end encryption

All data is encrypted at source, before transmission, using robust algorithms (AES-256-CTR with Poly1305 authentication). Cybee applies systematic multi-key encryption: each repository has its own encryption keys. Even if an S3 bucket were compromised, the data would remain unreadable without those keys.
Data integrity via hashing

Every data chunk is identified by its cryptographic fingerprint (SHA-256). Restic automatically verifies this fingerprint on every access, guaranteeing that no silent tampering is possible, neither in transit nor at rest.
Logical immutable snapshots

Each backup creates an independent logical snapshot. A snapshot never modifies previously written data: Restic adds new data without ever overwriting existing data. This property makes Restic backups inherently resistant to a wide range of attack vectors.

S3 object storage: additional protection against destruction

S3’s Write Once Read Many (WORM) mode allows an object to be locked for a defined period: neither deletion nor modification is possible during that time.

Even in the event of S3 access credentials being compromised, your backups remain intact.

Cybee implements this mechanism using a two-tier pattern: an “active” bucket for standard Restic operations, and a “vault” bucket with Object Lock enabled — ideally in a separate account.

This separation is essential to prevent Object Lock from blocking Restic’s internal operations (lock management, pruning).

Cybee’s complementary security mechanisms

Beyond Restic and S3 storage, Cybee integrates specialised security components to manage identities, permissions, and traceability across the entire platform.

Identity management with Zitadel

Cybee relies on Zitadel, an open-source Identity Management System (IDM), to authenticate every actor on the platform: human users, backup agents, automated processes, and API access.

Each customer organisation has its own isolated identity space. Rights delegation between organisations (for example, for a managed service provider such as Nuabee supervising multiple clients) is handled explicitly, with full auditability and revocability. No shared identity between clients is possible.
Fine-grained access control with a ReBAC model

Cybee uses a relationship-based access control model (ReBAC). Rather than simply assigning global roles, this model expresses contextual rights: “this user can access this backup plan because they are a member of the organisation that owns it.”

This model is particularly well suited to multi-tenant architectures and MSP use cases, where visibility and action boundaries must be strictly compartmentalised, even between colleagues using the same platform.
Separation of internal processes

Cybee distinguishes between several levels of internal processes (repository initialisation, metadata analysis, backup monitoring), each with its own S3 access keys scoped to specific, limited rights.

This compartmentalisation ensures that a compromise of one component cannot compromise the system as a whole.