Sovereign Backup
Sovereign Backup exports an encrypted copy of your detokenization vault — your tokens and the keys needed to decrypt them — sealed with a key that only you hold.
It answers the question every CTO asks before signing: what happens to my data if Veilio disappears?
Who is this for?
- Teams that would lose access to their data if their own database were wiped or ransomed
- Teams that need a documented exit path from Veilio (procurement, due diligence, DORA)
- Anyone who wants to detokenize without depending on Veilio being online
Pro or Enterprise plan required (or on-premise deployment).
What problem it solves
Tokenization splits the data from its meaning: your database holds tokens, Veilio holds the mapping. That split is the security benefit — and the availability risk.
| Scenario | Without Sovereign Backup | With Sovereign Backup |
|---|---|---|
| Your database is wiped or encrypted by ransomware | Tokens are gone from your side | Restore tokens and values from your bundle |
| Veilio is down | Detokenization unavailable until service returns | Detokenize offline, immediately |
| Veilio is compromised | Attacker cannot read your bundles (they lack your private key) | Same — plus you keep an independent copy |
| You leave Veilio | Requires a coordinated migration | You already hold a complete, self-describing export |
Security model
- The key pair is generated in your browser. The private key is downloaded to your machine and never sent to Veilio.
- Veilio stores only your public key and its SHA-256 fingerprint.
- Each bundle is encrypted with a random AES-256-GCM content key, itself wrapped with your public key using RSA-OAEP / SHA-256.
- Veilio cannot read a bundle it just produced. A full compromise of Veilio does not expose your backups.
- Destination credentials (S3 secret key, auth header) are encrypted at rest with the Veilio master key and are never returned by the API.
Setup (dashboard)
- Sign in as the organization Owner.
- Open Dashboard → Sovereign Backup.
- Click Generate my key. Your private key (
veilio-recovery-key.pem) downloads immediately — save it somewhere safe. - Verify the displayed fingerprint matches your key file.
You can now use either mode — or both.
Manual export
Click Download a backup whenever you want. The bundle is generated on demand and downloaded through your browser.
Automatic backup
Configure a destination, run Test, then flip the toggle:
| Destination | What you need |
|---|---|
| S3-compatible storage | Endpoint, region, bucket, object key, access key ID and secret. Works with AWS S3, Cloudflare R2, Scaleway, MinIO, and Backblaze B2. Enable path-style URLs for MinIO. |
| HTTPS endpoint | Any URL that accepts a PUT, with an optional auth header. Works with presigned URLs and internal storage gateways. |
Each scheduled run replaces the previous bundle at the same location. Your backup stays current without your storage growing over time.
| Plan | Minimum frequency |
|---|---|
| Pro | Every 24 hours |
| Enterprise | Hourly |
On Veilio SaaS, scheduled backups run automatically — no external cron to configure.
Bundle format
A bundle is a JSON envelope. Its metadata is readable without the private key; the payload is not.
{
"format": "veilio.sovereign-backup",
"version": 1,
"createdAt": "2026-08-12T1000.000Z",
"organizationId": "org_...",
"organizationName": "Acme",
"keyFingerprint": "sha256:...",
"algorithms": {
"keyWrap": "RSA-OAEP-256",
"content": "AES-256-GCM"
},
"wrappedKey": "base64...",
"payload": "base64...",
"stats": {
"tokenCount": 12480,
"userKeyCount": 3,
"truncated": false
}
}truncated: true means the organization exceeded the per-bundle token cap and the bundle is incomplete. Contact support@veilio.fr if you see this.
Restoring offline
The restore tool runs with no database, no network, and no Veilio account. That is what makes the escape hatch real.
# Inspect a bundle without decrypting it
npx tsx scripts/sovereign-restore.ts --bundle ./backup.veiliobak --inspect
# Restore to JSON
npx tsx scripts/sovereign-restore.ts \
--bundle ./backup.veiliobak \
--key ./veilio-recovery-key.pem \
--out ./restored.json
# Restore to CSV
npx tsx scripts/sovereign-restore.ts \
--bundle ./backup.veiliobak \
--key ./veilio-recovery-key.pem \
--format csv \
--out ./restored.csvOn-premise: the script ships in the deployment kit as scripts/sovereign-restore.ts (not inside the Docker image). SaaS customers download it from the Sovereign Backup page / support. It is intentionally self-contained (Node.js + built-in crypto only).
Output rows contain token, value, type, entityId, and createdAt — enough to rebuild your mapping or reload it into another system.
Rotating your key
Generating a new key does not invalidate old bundles: each bundle stays readable with the private key that was current when it was created. Keep your previous private keys as long as you keep the bundles they seal.
Rotation pauses automatic backups so you re-enable them deliberately, after confirming the new key is safely stored.
Operational notes
- Only the organization Owner can configure Sovereign Backup or trigger an export.
- Manual exports are rate-limited to 5 per hour and recorded in your audit log as
EXPORT_BY_USER. - Every run — manual or scheduled — appears in the backup history with its status, token count, size, and any error.
- Shredded tokens are excluded from bundles: a Sovereign Backup never resurrects data you deleted for compliance reasons.
- After a plan downgrade below Pro, automatic backups stop; existing bundles remain readable with your private key.