Security
The short version
MomentBackup runs on your computer and backs up to storage you control. When encryption is on, your files are encrypted on your machine before they leave it, with keys only you hold. There is no MomentBackup server in the path between your computer and your backup destination — we never receive or can read your data.
Encryption
- Strong, standard algorithms. Encrypted backups use XChaCha20-Poly1305 authenticated encryption, with keys derived from your passphrase using Argon2id. These are published, unmodified, widely-reviewed algorithms — no homemade cryptography.
- Your keys stay on your machine. The encryption key is generated locally and never transmitted. Your passphrase is never sent anywhere. The OS keychain can cache the key locally for unattended backups; it never leaves the device.
- A recovery key you control. Setup gives you a printable recovery key as a second way in. If you lose both your passphrase and your recovery key, your backups cannot be decrypted — by anyone, including us. That is the point.
No servers in your data path
MomentBackup is bring-your-own-destination: your backups go to your own disk, your NAS/SMB share, or your own cloud bucket or drive. We host no storage and keep no copy of your data. Your relationship with any third-party storage provider is directly with them.
The trial account is separate from your backups
A free MomentBackup account is required to download the app and start the account’s one trial. It contains account, sign-in, and trial start/end details, not backup files, encryption keys, passphrases, storage credentials, or a list of files you protect.
Paid licenses work offline and air-gapped
Paid license activation is verified offline against a key embedded in the app. A computer that never touches the internet can be licensed by typing the key or carrying a license file on a USB stick. Restoring your existing backups is never gated behind a license check.
Integrity you can verify
Backups are content-addressed and checksummed (BLAKE3), so corruption is detectable. MomentBackup can verify a backup and repair recoverable damage, and a safe restore drill for local or mounted backups lets you confirm a real restore works before you ever depend on it. Where your cloud provider supports Object Lock / WORM retention, an off-site copy can be made immutable so it survives accidental or malicious deletion.
Reporting a vulnerability
Email support@momentbackup.com with "security" in the subject. Include what you found, how to reproduce it, and what an attacker gets out of it. If you would rather send the details encrypted, send a first mail with no detail and we will arrange it.
What to expect. An acknowledgement within five business days, an assessment and a fix plan after that, and updates from us until it is closed. We ask for 90 days before public disclosure, and will move faster on anything already being exploited. We will credit you by name in the release notes if you want that, and leave you out if you do not.
In scope. The MomentBackup app, MomentBackup Hub, the licensing and account services on our domains, and this website. Out of scope. Denial-of-service, spam or social engineering against us or our suppliers, and reports that amount to a missing hardening header with no path to impact.
There is no bug bounty. This is a small product and paying for reports is not something it can currently do — we would rather say that plainly than let anyone spend a weekend expecting otherwise. Good-faith research on software and services you control is welcome, and we will not pursue anyone who stays inside the scope above and does not touch other people's data.