How Protectory protects your data

Protectory holds two kinds of sensitive data: the connection details it uses to back up your database, and the backups themselves. This page describes how they are protected.

Envelope encryption

Connection details and every backup are encrypted with a key of their own (a data key), and that key is itself encrypted with a master key kept outside the database. A database leak alone does not reveal your credentials or your data.

Every backup is test-restored

After each backup, Protectory restores it into an isolated scratch database and checks the tables and row counts. A backup that does not restore is reported, not kept as if it were fine.

Scanner network protection

Every request the scanner and the alert channels make is checked against private, loopback and cloud-metadata addresses, on every redirect and again at connect time, so a scan target cannot be used to reach internal systems.

Two-factor authentication

Accounts can turn on two-factor authentication; operators and support staff must use it. Sessions can be reviewed and ended from the account page.

Audit log

Sensitive actions (restores, exports, API and MCP use, key changes, domain proofs) are written to an audit log.

Read-only by design

Scans are passive and never change your site. Database access uses a read-only role; restores go to a new database or a download unless you choose otherwise.

Subprocessors

4 service providers process data for Protectory. Subprocessors

Responsible disclosure

Found a security problem in Protectory? Please write to the address in our security.txt; we answer every report. security.txt