When you entrust your backups to a provider, you are handing a complete copy of your data to an outside party. Source-side encryption is the mechanism that makes that trust unnecessary, because it changes the question from “do I trust them?” to “can they read it even if they wanted to?”.
Source-side versus destination-side encryption
Almost every provider says they encrypt your backups. The crucial difference is where it happens and who holds the key.
With destination-side encryption, your data travels and arrives at the provider, who encrypts it on storage with a key they manage. It protects against physical theft of a disk, and not much more: the provider can decrypt whenever they want, and so can a court order or an employee with access.
With source-side encryption, the data is encrypted on your server, before it leaves, with a key only you hold. The provider stores blocks it cannot interpret. It is not that they promise not to look: it is that they cannot.
What it really protects
Source-side encryption covers three scenarios destination-side does not: a provider employee snooping, a breach in the provider’s infrastructure, and a third-party request directed at the provider instead of at you. In all three, what is obtained is unreadable blocks.
And what it does not protect
It pays to be honest about the limits. Encryption protects confidentiality, not availability: an attacker able to delete your backups deletes them anyway, encrypted or not. For that you need your production server to have no write permissions on the destination, which is a different matter.
Nor does it protect against an attacker already inside your server, because that is where the key lives.
The responsibility you take on
And here is the trade-off, which has to be said plainly: if you lose the key, your backups are unrecoverable garbage. Nobody can help you. There is no password recovery, no support team that can do anything, no exception. That is precisely what it means for the provider not to hold it.
So if you enable source-side encryption, key management stops being a technical detail and becomes a procedure:
- Store it in two independent places, neither of them on the server you are backing up.
- Make sure more than one person knows it. If the only holder leaves the company or something happens to them, it becomes the company’s problem.
- A company password manager with controlled shared access is the most practical solution.
- Test a restore starting only from the stored key, not the one on the server. It is the only way to know the copy of the key actually works.
How to decide
The useful question is not whether source-side encryption is better, but whether your organisation can guard a key with the necessary discipline.
If you handle third-party data under confidentiality duties, medical data, financial information or trade secrets, the answer is that you should do it and organise yourself to guard the key. If you are a small company without procedures and a real risk of losing it, destination-side encryption with a provider in your own jurisdiction is a reasonable and honest position.
How we offer it
Our backup services support optional source-side encryption: if you enable it, the key is generated and stays on your side, and we store blocks we cannot read. We explain it with the implications up front, including losing the key. And if you prefer not to take on that responsibility, storage across our two data centres in Andorra already places you under Andorran law from day one.