--- title: "Encrypted backups, updates and migration" description: "Backups encrypted by default, restores with a safety checkpoint, moving between machines and signed updates with rollback." url: https://claqon.com/en/features/backups-and-updates/ language: en updated: 2026-10-12 alternates: es: https://claqon.com/funciones/copias-y-actualizaciones/ pt: https://claqon.com/pt/funcionalidades/backups-e-atualizacoes/ --- Backups, updates and moves # Encrypted backups and signed updates for your installation Because CLAQON lives on your machine, backups, updates and moving to another machine are in your hands. Backups are encrypted by default, updates arrive signed and are undone if they fail before the point of no return, and there is always an emergency exit to get back to a working state. [Pre-register](https://claqon.com/en/pre-registration/?modulo=funcion-copias#configurador) [See security and privacy](https://claqon.com/en/security/) - Backups with AES-256-GCM by default - Updates signed with Ed25519 - Rollback if something fails What it solves ## Self-hosted does not mean facing a failure alone Having the software on your machine gives you control of your data, but also the responsibility for not losing it. A half-finished update or a failing disk can leave you unable to produce. CLAQON comes as standard with encrypted backups and restore points, a move between machines that does not leave two diverging installations, and an updater that undoes its changes if it fails before the point of no return. How it works ## How to move CLAQON to another machine The move is a four-step walkthrough from the panel. By default, the source is frozen so that the two installations do not diverge. 1. **Prepare** It checks the health of the services and the free disk space before starting. 2. **Freeze and create the checkpoint** It stops production, pauses the workflows and creates a consistent backup of the data and databases. 3. **Move** You download the package, encrypted by default with your password, and take it to the new machine. 4. **Activate the destination** The destination is verified before it is activated, with confirmation that the source is switched off. Capabilities ## Backups, restores, updates and licences - **Encrypted backups by default**: Block-wise AES-256-GCM, with the key derived with scrypt from your password (12 to 1,024 bytes). An unencrypted backup is optional and comes with a warning. - **Restore points**: Protected or rotating, with a label and notes. You can download them and upload backups. - **Scheduled backups Beta**: From daily to monthly, keeping 1 to 30 backups. - **Restore on the same machine Beta**: Data only or everything included. First, a safety checkpoint protected for 7 days is created and, if something fails before the point of no return, everything is undone automatically. - **Moving between machines**: It freezes the source, creates a checkpoint that you download and activates the destination after verifying it, without the two installations diverging. - **Portable recovery tool Beta**: A standalone program to decrypt your backups without depending on the panel. - **Signed updates Beta**: Ed25519 signature, SHA-256 per file, semantic versioning, an increasing sequence and a 180-day expiry. The public key is pinned the first time by typing “CONFIAR” (Spanish for “trust”). - **Rollback Beta**: The updater is transactional: it undoes the changes if it fails before the point of no return and keeps the workflows’ local credentials. - **Licences per installation Beta**: A signed envelope with capabilities, a maximum version and a check every 6 hours. It is not DRM. - **Master installation for resellers Beta**: Client fleet, single-use installer seals valid for 90 days, signed notifications with acknowledgement and a signed model catalogue. - **Emergency exits**: “Resume the factory”, “Force unlock” and cancelling a move, also from the console when the panel is down. They never depend on the licence. Limits ## Limits worth knowing about - The safety checkpoint created before a restore is stored unencrypted, protected for 7 days. - If you choose an unencrypted backup, it is not encrypted. And if you lose the password for an encrypted backup, nobody can open it for you. - Restoring does not reactivate automation: it stays paused until you start it yourself from System. - You apply updates yourself from the panel or the console; a version’s expiry does not stop an installation that already has it. - The installers for Windows 10/11 and Linux (Debian or Ubuntu) are in beta; there is no installer for macOS. - Through a Cloudflare tunnel you can upload backups of up to 100 MB: larger ones, from the machine itself. Frequently asked questions ## Questions about backups and updates ### What happens if an update fails? The updater is transactional: if it fails before the point of no return, it undoes its changes and leaves the installation as it was. If it is left half-finished, the panel offers “Resume the factory” and “Force unlock”, and there are equivalent commands in the console. ### Are my backups encrypted? By default, yes: AES-256-GCM with a key derived from your password. There are two exceptions worth knowing about: the unencrypted backup, if you expressly choose it, and the safety checkpoint before a restore, which is stored unencrypted for 7 days. ### Can I move CLAQON to another computer? Yes, with the move: the source is frozen, a checkpoint is created, you download it and you activate the destination after verifying it. If you prefer to keep producing during the move, whatever is produced afterwards does not travel to the destination. ### Can the licence lock my data? The licence never deletes data or activates workflows, and the emergency exits do not depend on it. Nor is it DRM: what it really controls is what the master installation signs, such as each installation’s versions and capabilities. ### What is the master installation? The installation from which a reseller issues signed licences and single-use installer seals for their clients’ installations, and sends them signed notifications. It is in beta. [See the partner programme](https://claqon.com/en/partners/). Early access ## Protect your installation from day one Tell us which machine you would work on and how you back up today. We will tell you how CLAQON fits the way you work. [Pre-register](https://claqon.com/en/pre-registration/?modulo=funcion-copias#configurador) [See the done-for-you setup](https://claqon.com/en/done-for-you-setup/)