Backups & export

A backup captures everything OpenClaw writes to disk — the /data Docker volume, which holds:

• Conversation history and memory store.
• Skills and their state.
• The OpenClaw SQLite / Postgres state, depending on build.
• Files your bot has generated or uploaded through skills.

We do not back up the container images themselves — those are re-pullable from the OpenClaw registry — nor the system disk. Everything that matters is on /data.

Schedule

Nightly at 03:00 UTC, triggered from the control plane

Destination

Cloudflare R2, region-matched to your VM (SG/US/EU)

Retention

14 snapshots: 7 daily + 4 weekly + 3 monthly

Final backup

Taken automatically on VM deletion; stored for 90 days

If a given night's run fails — transient R2 error, agent offline, disk pressure — we retry once an hour for the next six hours. You'll see a banner in the dashboard if two consecutive nights fail.

Every snapshot is encrypted before it leaves your VM. The key is derived per-customer:

backup_key = HMAC-SHA256(platform_secret, user_id)

The platform_secret lives in Supabase Vault, never in application code. The agent fetches a signed key blob on demand, uses it for the tar | gzip | openssl enc -aes-256-gcm pipeline, then discards the plaintext key.

You can pull a full snapshot on demand without waiting for the nightly run.

1. Dashboard → Backups → Export now.
2. The control plane calls POST /api/dashboard/vm/export-data, queues an export_now command to the agent.
3. Agent writes a fresh snapshot to R2 and reports the object key back.
4. We generate a pre-signed R2 URL valid for 24 hours and email it to your account address.

The exported file is the same encrypted blob as a nightly backup. To decrypt it offline, you'll need your per-customer key — request it from support@nacre.sh after identity verification, or use the in-dashboard "Decrypt locally" helper which streams the key one-time and never caches.

Restore is a coordinated operation because it overwrites /data. Today this is a supported path via support — not a self-serve button, to prevent accidental wipes.

1. Email support@nacre.sh with the VM hostname and target snapshot date.
2. We pause OpenClaw on your VM, download the snapshot, decrypt it, and swap /data.
3. OpenClaw restarts. Memory and skills return to the snapshot state; messages received between snapshot time and restore are not replayed.

We keep your last backup for 90 days after cancellation. During that window:

• You can resubscribe from the same account and we restore to the last snapshot on a fresh VM.
• You can request an export and get a pre-signed URL for local download.

At day 90 we purge the backup object and the per-customer key material. After that, the data is unrecoverable — by us or anyone else. If you need a longer retention window for compliance, email support@nacre.sh before the 90-day mark.

Dashboard → Backups shows the last 14 snapshots with:

• Timestamp (UTC).
• Size (compressed, encrypted).
• SHA-256 of the ciphertext.
• R2 region.

The agent also writes the last success time into its heartbeat, so the overview page shows "Last backup: 4 hours ago" at a glance.