Rested

Security controls you can verify

This page describes controls implemented in the product today. Rested does not claim SOC 2 or ISO 27001 certification.

Client-sealed secrets
The browser seals repository and database credentials to the enrolled agent’s P-256 public key. The control plane stores ciphertext; the agent opens it locally.
Encrypted repositories
Restic encrypts repository contents and metadata before upload. Encryption-password rotation is confirmed by the agent before Rested replaces the stored sealed credential.
Security audit trail
Enrollment, revocation, secret updates, storage-key rotation, restores, and manual backup actions are recorded in an append-only audit timeline.
Verified agent releases
The installer verifies a signed checksum manifest and the downloaded agent checksum before installation. Passkeys are available for account sign-in.

Clear boundaries

Security also depends on the customer’s server, recovery-key handling, storage configuration, and deployment environment. Save the repository encryption password outside Rested: it cannot be recovered by the service.