> We encrypt data in motion, but not at rest (yet). What does this even mean? When is data in motion or at rest? I hope your servers never see a single unencry

> We encrypt data in motion, but not at rest (yet). What does this even mean? When is data in motion or at rest? I hope your servers never see a single unencrypted byte. Just imagine lots of services using your backup system. That will make you a very very valuable target for hacking. You don't need to hack N services anymore, you only need to hack one. Also what encryption algorithms are used? What key lengths? How are the keys generated? And even if you do proper encryption, how can the authenticity of your software be verified? What if you where hacked and the hacker manipulated your software and thus installs back doors on all your customers through your software install/update method? Can a customer see the source of what is running on their server? > By default it backs up everything except /proc and /sys I guess you don't include the encryption keys in the backup, so there has to be something more excluded. Also what about /tmp?