Backup
Managed, scheduled, encrypted backups for your PostgreSQL and MongoDB databases.
Backup takes scheduled backups of your PostgreSQL and MongoDB databases and stores them encrypted in S3 — either in Norcube-managed storage or in an S3-compatible bucket you own. You connect a database, attach a backup policy (cron schedule + retention + destination), and Backup handles execution, encryption, downloads, and cleanup.
The mental model
| Concept | What it is | Scope |
|---|---|---|
| Datasource | A database you've connected: engine, environment tag, region, encrypted credentials. | Organization |
| Backup policy | A reusable template: cron schedule + timezone + retention rules + storage destination. | Organization |
| Attachment | A policy bound to a datasource, with its own enabled flag and priority. One policy can be attached to many datasources. | Datasource × policy |
| Backup job | One execution — scheduled or manual. Records status, duration, size, and where the archive landed. | Datasource |
| Storage destination | An S3 bucket archives are written to: Norcube-managed, or BYO (R2, B2, Wasabi, MinIO, AWS S3 in your account). | Organization |
| Audit log | Append-only timeline of every sensitive action. | Organization |
The separation matters: datasources say what to back up, policies say when, how long to keep, and where, and the attachment is the switch that connects the two.
What you can do
Connect a database
Postgres or MongoDB. Credentials are KMS-encrypted and the connection is verified on save.
Schedule recurring backups
Cron schedule, timezone, retention, destination — defined once, attached to many databases.
Run a backup on demand
Kick off an ad-hoc backup with one click; it runs alongside the schedule.
Download a backup
Short-lived signed URLs for backups in managed storage.
Bring your own bucket
Cloudflare R2, Backblaze B2, Wasabi, MinIO, or AWS S3 in your account — verified end-to-end before saving.
Audit every action
Who did what to your datasources, policies, destinations, and jobs.
There's also a CLI (nrc snapdb) for listing backups
across the whole organization, pausing and resuming schedules, and
scripting against the same API the dashboard uses.
How a backup runs
When a backup fires — scheduled or manual — Backup launches a short-lived, isolated worker container that:
- Fetches its one-job work order and decrypts your database credentials inside the container (KMS envelope encryption — see Encryption and security).
- Streams
pg_dumpormongodumpoutput through gzip directly to S3 — no local disk, no intermediate files. - Reports the result (S3 location, size, duration — or a classified, human-readable error) back to the Backup control plane.
The container is destroyed when the job ends. Every backup is a full
logical dump — restorable with the standard pg_restore /
mongorestore tools; see
Supported engines.
Behind the scenes, three system workers keep things honest: a scheduler (enqueues jobs each minute from your cron schedules), a reaper (reconciles jobs whose worker vanished mid-run, healing them to success if the archive actually landed), and a retention worker (deletes archives that have aged out of policy). All three leave audit-log trails.
Pricing
Backup bills on two dimensions:
- Storage — per GB of backups retained per month (only for Norcube-managed destinations; you pay your provider directly for BYO buckets).
- Compute — per second of backup job runtime.
See pricing for current rates, and Platform → Billing for how invoicing works.