Easy way I've found that works for me: - Backup files are encrypted with gpg. - Pull from local backup server with a backup account that only has read-only ac

Easy way I've found that works for me: - Backup files are encrypted with gpg. - Pull from local backup server with a backup account that only has read-only access to the directories you need to backup. - Push to remote backup server with versioning (I'm using rclone with s3, if you need to backup large amounts this could potentially get too expensive). You can restrict the s3 credentials so that the user pushing from your server isn't able to permanently delete any files. There are plenty of other options out there, the key takeaway is a staging server for offsite backups and the principal of least privilege.