Less time babysitting backups. More confidence they'll work.
Secure Store gives you a backup system that lives on your hardware, encrypts everything it stores, and asks nothing of your firewall. Here's what's inside — and why it matters to you.
Your backups stay where you put them.
rubixd is a Linux server you install on your own infrastructure. It's the one place every backup lands — and it never phones your data home to a vendor.
- Hosts your safes, schedules, retention and verification
- Includes the console your team works from
- Keeps itself current with Hub online updates
Technical details
rubixd manages safes, schedules, garbage collection (GC), verification and the console. Packages ship through the Hub stable channel. Secure Store is software you run — not Rubix-hosted SaaS.
Protect every machine without opening it up.
Agents reach out to your server. Nothing reaches in. That means no inbound firewall rules on the hosts you protect — and it works behind NAT.
- Windows agents back up VSS volumes
- Linux agents back up file trees
- Runs as a service so schedules survive reboots
Technical details
Enroll by pointing the agent at your rubixd URL. Channels: agent-win-x64 (VSS volumes) and agent-linux-x64 (file trees). Linux agents don't back up LVM block volumes; there's no Microsoft 365 agent.
Encrypted by default. Unreadable by design.
Every safe is encrypted at rest with AES-256-GCM. Turn on end-to-end mode and the server never holds plaintext or the keys to decrypt it.
- AES-256-GCM encryption at rest
- Optional E2E mode keeps keys with you
- A breached server yields ciphertext and metadata — not files
Technical details
In E2E mode, rubixd does not hold plaintext backup contents or the keys required to decrypt them; operators still see metadata and job status. Outside E2E mode, who holds keys depends on your deployment. Security model.
Keep what matters. Let the rest go automatically.
Chunk-based backups only store what's changed, and deduplicated safes avoid keeping the same data twice. Retention rules and garbage collection keep disks tidy without anyone babysitting them.
- Block-efficient, chunk-based backup
- Deduplicated safes
- GFS retention with automatic garbage collection
Technical details
Changed-block-style chunks; deduplication operates on ciphertext. Grandfather-father-son retention decides what's kept; GC reclaims space per those settings.
Find problems on a Tuesday, not on restore day.
Schedule your backups, schedule verify jobs against your safes, and get alerted when something needs attention. Restores come straight from your safes.
- Flexible schedules
- Backup verification jobs
- Alerting on job status
Updates and licences, without the busywork.
rubixd and your agents keep themselves current from the Rubix Hub. Licences are tied to a specific deployment and activate in seconds — no restart required.
- Online updates on published channels
- Licensing and plans through the Rubix Hub
- Licence keys verify offline against the build
Clear about what's in — and what isn't.
So you can plan with confidence.
| Area | Secure Store today |
|---|---|
| Windows | VSS volume backup via the Windows agent |
| Linux | File-tree backup via the Linux agent (not LVM block volumes) |
| Microsoft 365 | Not included |
| Hosting | Self-hosted only — Rubix does not host backup data |
| Peer replication | Not complete — don't plan around it yet |
| Certifications | No HIPAA or SOC 2 certification claimed |
See the features on a setup like yours.
Book a walkthrough and bring your questions about agents, retention and encryption — or join the waitlist to get packages first.