Security & privacy

BackupLatte is preparing to launch. Account creation and backups are not available yet. Join the waitlist for updates.

Security

A backup service holds a copy of everything in your workspace, so it has to be dull and careful. This page describes what BackupLatte does to protect that copy.

Access to Linear

• You connect through Linear's OAuth. BackupLatte never sees your Linear password.
• It asks for read access to make backups and write access only to perform restores you start. Linear's admin access is requested only when you turn on extended coverage.
• Linear access tokens are stored encrypted with AES-256-GCM and renewed automatically. Disconnecting a workspace deletes them.
• You can revoke BackupLatte's access at any time in Linear's settings.

Your backups

• Snapshots and copied files are stored in a private Cloudflare R2 bucket under its EU jurisdiction. Nothing in it is public.
• Downloads use private links that expire after 15 minutes.
• Other BackupLatte accounts cannot see, download or restore your backups.
• Credentials, webhook URLs and secrets of integrations and webhooks are never collected, and neither are Linear's security settings or users' personal items. See What a backup contains.

Your account

• Passwords are stored only as bcrypt hashes.
• Sessions use short-lived tokens (15 minutes) renewed through an HTTP-only cookie that lasts up to 7 days. Log out ends the session.
• Sign-in attempts are rate-limited per IP address and per email.

Infrastructure

• The application, database and background jobs run on servers in Germany (Hetzner, Falkenstein).
• The website and the app are served by Cloudflare, which also sits in front of the application.
• Payments are handled entirely by Paddle, our Merchant of Record. BackupLatte never sees your card details.

The full list of providers and what they process is in the subprocessors list; how personal data is handled is described in the Privacy Policy and the Data Processing Addendum.

Report a security issue

Write to [email protected] with the details. Please do not test against other customers' data or run load tests against the service.

Something missing or unclear? Write to [email protected].