Security model
A disaster recovery platform holds a copy of everything worth stealing. It has to be defensible on its own terms, not on the strength of the network around it.
Agent to control plane
The agent-to-backend channel is mutually authenticated. Both ends present certificates issued by a CA you control, and either end refuses an unauthenticated peer rather than falling back to something weaker.
Certificates are rotated by reissuing the leaf certificates against the same CA, so rotation does not mean re-enrolling every host. Self-hosted deployments run their own PKI; there is no vendor-held key that unlocks your estate.
The agent connects outbound only. Nothing in the protected network has to accept an inbound connection for backups to run.
Public endpoints carry no credentials
Two endpoints are deliberately unauthenticated: the health probe and the translation catalogue. They are also the only two, and the console is built so that no credential is ever attached to them.
That is a security property with an operational payoff. The health probe is what distinguishes "the backend is unreachable" from "your session expired" — which is precisely the distinction you need at 3am, and precisely the one that disappears if the probe itself requires a token.
Immutability and retention
Immutability is a property of the policy, not a setting somebody remembers to tick. A point written under an immutable policy cannot be altered before its retention expires — which is the property that matters when the thing you are recovering from is an attacker who reached your infrastructure rather than a failed disk.
Retention is enforced by the platform and expressed in the policy, so "how far back can we go for this asset" has one answer and it is written down.
Access
Operator actions require an authenticated account with an appropriate role. Reading into an archive — listing a recovery point's contents, extracting a file — requires project or platform administrator rights, because inspection is by design a read of the protected data itself and should not be available to anyone who can merely see that a job succeeded.
Demo sessions are read-only and never touch a real backend.
Audit
Every operator action and every run is recorded: what ran, against which asset, with what outcome, initiated by whom, and when. The trail is written continuously, which is the only way it is ever useful — an audit log started in response to an incident documents the response, not the cause.
Data residency
Recovery points land in storage you nominate: your bucket, your region, your lifecycle policy. In the self-hosted deployment nothing leaves your perimeter at all, which makes air-gapped estates a supported configuration rather than an exception.
Reporting a vulnerability
Mail contact@daydev.org. We would rather hear it from you than read it somewhere else.