Skip to content
Rested

Security controls you can verify

This page describes controls implemented in the product today. Rested does not claim SOC 2 or ISO 27001 certification.

Implemented security controls

Client-sealed secrets

The browser seals repository and database credentials to the enrolled agent’s P-256 public key. The control plane stores ciphertext; the agent opens it locally.

Encrypted repositories

Restic encrypts repository contents and metadata before upload. Encryption-password rotation is confirmed by the agent before Rested replaces the stored sealed credential.

Security audit trail

Enrollment, revocation, secret updates, storage-key rotation, restores, and manual backup actions are recorded in an append-only audit timeline.

Verified agent releases

The installer verifies a signed checksum manifest and the downloaded agent checksum before installation. Passkeys are available for account sign-in.

Clear boundaries

Security also depends on the customer’s server, recovery-key handling, storage configuration, and deployment environment. Save the repository encryption password outside Rested: it cannot be recovered by the service.