Off-box copies

Packbat encrypts each changed archive object and the index to an age public recipient in a local outbox. Only the resulting ciphertext is handed to rclone. The private identity is not kept in the archive config.

The wizard can configure an S3-compatible store, SFTP, or any rclone destination. S3-compatible and SFTP remotes can use a Packbat-managed rclone config. A custom destination can use your default rclone config instead.

S3-compatibleSFTPAny rclone destination

The recovery kit holds the age identity, the recipient, the remote location, and fresh-machine restore commands. It holds the only key. Keep a copy somewhere safe off this machine, such as a password manager. If every copy is lost, nobody can recover the remote archive.

Uploads are copies, never syncs. Packbat sends new or changed encrypted objects and an encrypted index. It does not ask rclone to delete remote files, so a local removal cannot remove the off-box copy.