Security & privacy
BackupLatte is preparing to launch. Account creation and backups are not available yet. Join the waitlist for updates.
Security
A backup service holds a copy of everything in your workspace, so it has to be dull and careful. This page describes what BackupLatte does to protect that copy.
Access to Linear
- You connect through Linear's OAuth. BackupLatte never sees your Linear password.
- It asks for
readaccess to make backups andwriteaccess only to perform restores you start. Linear'sadminaccess is requested only when you turn on extended coverage. - Linear access tokens are stored encrypted with AES-256-GCM and renewed automatically. Disconnecting a workspace deletes them.
- You can revoke BackupLatte's access at any time in Linear's settings.
Your backups
- Snapshots and copied files are stored in a private Cloudflare R2 bucket under its EU jurisdiction. Nothing in it is public.
- Downloads use private links that expire after 15 minutes.
- Other BackupLatte accounts cannot see, download or restore your backups.
- Credentials, webhook URLs and secrets of integrations and webhooks are never collected, and neither are Linear's security settings or users' personal items. See What a backup contains.
Your account
- Passwords are stored only as bcrypt hashes.
- Sessions use short-lived tokens (15 minutes) renewed through an HTTP-only cookie that lasts up to 7 days. Log out ends the session.
- Sign-in attempts are rate-limited per IP address and per email.
Infrastructure
- The application, database and background jobs run on servers in Germany (Hetzner, Falkenstein).
- The website and the app are served by Cloudflare, which also sits in front of the application.
- Payments are handled entirely by Paddle, our Merchant of Record. BackupLatte never sees your card details.
The full list of providers and what they process is in the subprocessors list; how personal data is handled is described in the Privacy Policy and the Data Processing Addendum.
Report a security issue
Write to [email protected] with the details. Please do not test against other customers' data or run load tests against the service.
Something missing or unclear? Write to [email protected].