If someone takes over your hosting login, a locked copy should still sit somewhere else. Protected means we checked an encrypted copy in a bucket off this host (Amazon S3, Cloudflare R2, or Backblaze B2) inside the keep window. A copy on the same computer is At risk. Never verified is Unknown.

We lock the copy before it leaves. Paste bucket keys in Hub Backups. Show asks for your Hub password, and 2FA when enrolled. Save keys and Remove stored keys also need your Hub password, and 2FA when enrolled. Show is also rate limited. Server environment keys still work and win if set. We never write keys to logs or git.

We never delete the last good offsite copy when a new copy fails. If this computer looks dirty, restore the Hub offsite copy taken before the hack. Restore needs a working Hub link.

Needs a bucket and keys. An attacker who also has those keys is out of scope. First Protected needs a successful run. This is not a substitute for host patching. You never change DNS.

Open Backups or Read the short note.