Zero-Access Security
Vecta keeps backup contents, repository passwords, and storage credentials off the hosted control plane while retaining the metadata needed to operate a dashboard.
What the control plane sees
| Category | Information stored |
|---|---|
| Account and agents | Account email; agent names, IDs, versions, and check-in times |
| Job configuration | Job name, source path, destination URL including bucket, host, or path; schedule; SSH port |
| Run metadata | Status, exit code, duration, progress, files and bytes processed or transferred, snapshot IDs, and a short tail of an agent error message |
Destination URLs are visible by design. The dashboard needs them to coordinate jobs and display where a job writes.
What it never sees
- The repository password that encrypts the restic repository.
- S3-compatible access keys or Backblaze B2 keys.
- SSH private keys.
- File names and file data from your backups.
The agent streams data from your server directly to your storage. Credentials and repository passwords remain on the agent machine in protected local files.
One-time secrets
The repository password and agent API key are shown once. The registration token is single-use and expires after 24 hours.
Agent isolation
Each agent has its own API key and can read only the non-secret configuration for its own jobs. It cannot read another agent's jobs or another user's data.
What this means in practice
A compromise of the control plane exposes metadata, including what you back up, when it runs, and where it writes. It does not expose backup contents, credentials, or repository passwords. A compromise of an agent machine is different: that machine holds the credentials needed to access its own backups. Harden agent machines like any system that can read your source data.
What's next
Read The pull-based agent model to understand the network boundary, then Destinations for credential setup.