Open source enterprise backup
With backup software, one question outweighs all others: can you check what it does with your data? The lionbackup client is open source under the MIT license. Encryption, key handling and upload can be read line by line.
On this page
Why open source matters for backup · What is open, and what is not · Verify it yourself · Common questions
Why open source matters more for backup than anywhere else
A backup client gets everything a company owns in data. It reads every file, holds the keys and opens the connection to the outside. With closed software, all you can do is take the vendor’s word for it: that data really is encrypted before upload, that the private key never leaves the building, that no telemetry runs along. Those three points can be read in the source code instead of taken on trust.
Then there is the practical side: an open-source client can be audited by your own security team, built by yourself and, if it comes to it, kept running. That also answers the question of what happens if a vendor changes its terms.
What is open, and what is not
Honesty is part of the subject, so the boundary comes first: lionbackup is not a fully open-source product but a service with an open-source client. That client is the part your data security depends on.
Open source: the client
The entire program that runs on your systems (Linux, Windows and macOS as a beta): encryption, compression, key generation, upload and restore. MIT license, publicly readable and downloadable without registration. The graphical lionbackup Wizard is MIT-licensed as well.
Not open source: the service side
Storage service, portal and billing are proprietary. They only ever handle ciphertext and metadata: your content arrives there already encrypted.
The container image too
The client is also published as a container image, which you can build reproducibly yourself from the same source code.
No lock-in
The interface is documented and the archive format is openly described. You can restore everything at any time and move elsewhere.
What you can verify in the source code
Three claims every backup vendor makes, and which you can check with us:
Encryption before upload
Archive, compress, encrypt, and only then transfer: that order can be traced in the code. It uses a post-quantum hybrid scheme of ML-KEM-768 and X25519.
Your private key stays with you
It is generated locally, and only the public part goes into the configuration. The client has no code path that transmits it.
No hidden communication
The client talks to the storage nodes of the zone you chose. Which connections it opens is in the source code, and you can cross-check it with a network capture.
The full source code is at git.lionbackup.cloud/lionbackup/lionbackup-client. How the client is used day to day, including as a container with Docker Compose, is described in the documentation.
Common questions
Is lionbackup open source?
The client is: fully open source under the MIT license. The service side (storage service, portal, billing) is proprietary. Since encryption happens exclusively in the client, exactly the part that decides the confidentiality of your data is open.
Which license applies to the client?
The MIT license. It allows use, modification and redistribution, including commercially, and only requires that the license notice is kept.
Can I compile the client myself?
Yes. The client is a single, statically linked Go program with no runtime dependencies. The published container image is built from the same source code.
Can I check that data really is encrypted before upload?
Yes, in two ways: in the source code along the processing chain, and in practice with a network capture. Only ciphertext is transferred.
Is lionbackup suitable as open source enterprise backup?
Yes. The open-source client meets a platform built for business use: organisations and projects, fine-grained roles, an audit log, a REST API and immutable (WORN) storage you can switch on. More on the page cloud backup services for business. Our engineers support the rollout free of charge.
What happens if I want to stop using lionbackup?
You restore your data in full with the client and end the service. There is no minimum term, and because the client is open source, you keep access to the archive format independently of us.
Isn’t an open-source client less secure because attackers can read the code?
No. Security comes from the strength of the methods and the secrecy of the keys, not from keeping the program secret. Open code means flaws can be found by you and by us, not only by attackers.