ENDPOINT BACKUP

datalog

Encrypted, deduplicated, append-only backup with ransomware resilience.

An enterprise endpoint backup system: a cross-platform agent backs up important files to a secure, immutable repository and protects them against ransomware and malware.

“Assume the endpoint will be compromised.” The agent can only append — existing backups cannot be deleted, overwritten, or read by an attacker who owns the machine. A content-addressed, deduplicated, append-only repository design.

THE PIPELINE

From file to immutable snapshot

Content-defined chunking finds duplicate data across every file and version; each chunk is hashed, compressed, encrypted, and appended to a store that has no delete or overwrite operation by design.

Watchchanged files
ChunkFastCDC
HashBLAKE3 id
Compresszstd
EncryptChaCha20-Poly1305
Appendsnapshot

AGENT · SERVER · STORAGE

What you get

Desktop agent

A native cross-platform desktop app (light/dark): unlock a repository, add watch folders, browse sets and restore a whole snapshot or a single file — all client-side with your keys.

Backup server

datalog-serverd — an append-only storage gateway for agents with a server-rendered admin web UI.

Flexible backends

Local, an http(s):// datalog server (email/password → JWT, auto-refreshed), or S3-compatible object storage with Object-Lock.

Continuous protection

Watch folders and auto-back-up on change (debounced), or schedule every N minutes. Backups and restores can be cancelled mid-flight.

Malware scanning

Signature- and rule-based scanning (including jara) with warn / skip / abort; infected sets and snapshots show ⚠ badges and a frozen-retention banner.

Integrity checks

An on-demand check verifies every referenced chunk. Secrets stay in memory; only non-secret settings are persisted.

EVERYTHING INCLUDED

Full capability list

The complete agent, server and storage feature set — all client-side encrypted.

Backup pipeline

  • Filesystem watch / change tracking
  • Content-defined chunking (FastCDC)
  • Keyed BLAKE3 content-ids
  • zstd compression
  • ChaCha20-Poly1305 + Argon2id encryption
  • Pack files + content-addressed index
  • Parallel pack uploads
  • Incremental cross-file dedup

Snapshots & restore

  • Snapshots with parents
  • Browse a snapshot's files
  • Restore a whole snapshot, file or subtree
  • Preserves unix mode + symlinks
  • Select by id, prefix or “latest”

Anti-ransomware

  • Append-only — no delete/overwrite
  • Anomaly detection scored vs. parent
  • Retention freeze on flagged snapshots
  • ⚠ badges + frozen-retention banner
  • WORM via Object-Lock

Integrity & privacy

  • Zero-knowledge (ciphertext only)
  • Tamper detection on every read (BLAKE3 + AEAD)
  • Secrets kept in memory only

Malware scanning

  • Scanned pre-encryption, client-side
  • Signature scanning
  • Rule-based scanning
  • Built-in jara engine (no external binary)
  • Policy: warn / skip / abort

Continuous & scheduled

  • Continuous protection (debounced watch)
  • Scheduled backups (every N minutes)
  • Cancel backups / restores mid-flight
  • Drag folders to protect

Storage backends

  • Local repository
  • Remote datalog server over http(s)
  • S3-compatible object storage
  • Object-Lock WORM (write-only credentials)

Desktop agent

  • Native cross-platform app (light/dark)
  • Create / unlock encrypted repository
  • Backup sets with live progress & status
  • Server-connection status indicator
  • Settings: protection, scanning, theme

Backup server

  • Append-only HTTP(S) gateway (no delete route)
  • Admin web UI — repos, users, sessions, audit
  • TLS with client CA-pinning
  • JWT sessions with server-side revocation
  • RBAC — Admin / Operator / Viewer / Agent
  • Last-admin protection

Maintenance

  • Privileged GC — prune, reclaim, compact
  • GC freezes if anomaly-flagged
  • On-demand integrity check
  • Server container packaging

UNDER THE HOOD

Technical profile

Model
Content-addressed, deduplicated, append-only repository — no delete or overwrite by design
Chunking
FastCDC — content-defined chunking for cross-file, cross-version dedup
Hashing
Keyed BLAKE3 content-ids
Compression
zstd
Encryption
Argon2id KDF + ChaCha20-Poly1305 AEAD
Backends
Local · http(s) server (JWT) · S3-compatible object storage with Object-Lock
Agent
Native cross-platform desktop app — drag-to-protect, live progress, cancel any time
Scanning
Signature- and rule-based (including jara) — warn / skip / abort
FastCDCBLAKE3zstd ChaCha20-Poly1305Argon2idObject-Lock immutablededupsnapshots continuous protectionintegrity check