How downpipes works
downpipes takes a backup, seals it to your own destination, and reads it back to prove it can be recovered, and you recover your data either in the console or offline with the open-source reader. This page is the short tour of that path for an evaluator or a new operator; the concepts and operations sections carry the depth.
Taking a backup
Connect a source
You connect a Cloudflare data source with a read-only discovery token. The engine stores that token in its Durable Object, verified live and audited, never re-shown, because later runs read your Cloudflare configuration and Workers through it. The separate one-shot key-install token is different: you supply it per request and the engine uses it in memory only, never storing it.
Seal the archive
Each backup is encrypted and signed, then written to your own destination. The encryption is post-quantum hybrid: a classical and a post-quantum algorithm together, with both halves required.
Prove it
downpipes reads the archive back and verifies it, so a clean result means the backup is recoverable rather than merely written.
Authored from code
Every page on this site records the code files it was written from, so the docs stay pinned to the engine rather than to older prose that may have drifted.
Recovering your data
You can restore in the console, whether or not your engine holds an operational key, or recover offline with the open-source reader. A restore that overwrites live data is gated and is never automatic.
A restore is irreversible
A restore writes plaintext back into live resources and the engine does not roll back. So every restore apply needs both an explicit confirmation and a second authorised approver bound to the exact plan hash, where the maker is never the checker, regardless of how small the change looks.
Two ways to recover
Pick a run, review the dry-run plan and the blast radius, then apply once a distinct approver has signed off. On a strict, break-glass-only estate the console still restores: your browser supplies the break-glass key locally to open that one run, and only a 32-byte per-run master, never the break-glass private key itself, ever reaches the engine.
Use the open-source reader with your break-glass key to recover from your own destination bytes, with no vendor and no Cloudflare in the loop.
Common questions
Does the vendor hold my data or keys?
No. The engine runs inside your own Cloudflare account. In the two-recipient posture the in-account engine holds a decryption-capable operational key, so a full compromise of your account could read past archives. You can switch to a strict break-glass-only posture, where the engine holds nothing that can decrypt.
What can downpipes back up?
Eight kinds of thing in your Cloudflare account: Workers KV, R2, D1 and Secrets Store through a binding, plus your Cloudflare configuration, Worker scripts, Stream videos and Images through the read-only discovery token. The exact per-source behaviour is documented in the sources section.
Last updated .