Encrypted cloud backup, explained
Encrypted backup can mean three different things: data encrypted while it travels to the cloud (in transit), encrypted while it sits in storage (at rest), or encrypted on your own PC before it leaves, with a key only you hold (client-side). They protect against different problems, and providers often use the word without saying which one they mean. This guide explains all three, says what Tornova does today (in transit and at rest; client-side is planned, not available), and gives you a checklist for judging any backup provider.
Three things people mean by encrypted backup
Encryption scrambles data so that it can only be read with the right key. The question that matters is: who holds the key, and when is the data scrambled? The answer is different for each of the three common types.
Three kinds of encryption in a cloud backup
| Kind | When data is protected | Who holds the key | Main protection |
|---|
| In transit | While files travel between your PC and the cloud | Negotiated by your PC and the service (TLS) | Anyone watching the network, such as on public Wi-Fi, cannot read or alter the data in flight |
|---|
| At rest | While files are stored in the provider's cloud storage | Managed by the provider's infrastructure | Someone who gets at the raw storage, such as a lost disk, cannot read it |
|---|
| Client-side | Before files leave your PC, and while stored | You (or the app, using a key only you control) | The provider cannot read your files without your key |
|---|
All three are worth having, and the first two are widely expected of any serious service. Client-side encryption is a stronger and less common promise, with trade-offs that are worth understanding.
Encryption in transit
Encryption in transit uses TLS, the same technology as the padlock in your browser. It stops other people on the network from reading or modifying your data while it travels. It is the baseline for any upload. Modern services use TLS 1.2 or later; older versions have known weaknesses.
It does not protect data once it has arrived, and it says nothing about what the provider can see. It is necessary, but it is only one layer.
Encryption at rest
Encryption at rest means the data is stored in encrypted form on the provider's disks. If someone obtained the storage hardware, or raw access to it, they would not get readable files. Large cloud platforms apply this to the storage layer as standard.
The limit is that the provider's systems can still decrypt the data in order to serve it back to you, and the provider's staff and software may have a route to it that your own account controls do not close. Encryption at rest protects against theft of storage, not against everything. Strong access controls, short-lived access to storage and good account security matter just as much.
Client-side encryption, and why it is not simply better
With client-side encryption, your PC scrambles the files before they are uploaded, using a key that only you control. The provider stores data it cannot read. This is sometimes called end-to-end or zero-knowledge encryption, although those terms are used loosely, which is a reason to read the provider's description carefully.
The strength is also the cost. If the key is lost, nobody, including the provider, can recover your files. Some features that need to look inside files, such as server-side search or previews, are limited or impossible. And the app that does the encrypting becomes a thing you have to trust.
Rule of thumb Ask who can read your files if you forget the password and the provider cooperates fully. If the honest answer is nobody, the service is client-side encrypted. If the answer is that they can reset your access, it is not.
What Tornova does today
Tornova Backup uses the first two kinds today. Client-side encryption is planned and not available. Every Tornova account today is a Standard Secure Account.
- In transit: data is encrypted in transit using TLS 1.2 or later.
- At rest: data is encrypted at rest in cloud storage, which is Azure Blob Storage in the United States.
- Access to storage: storage is never publicly accessible. Access uses short-lived, controlled authorization.
- Device identity: each Windows Agent has its own device credential, separate from the user's sign-in.
- Integrity: file content is identified and verified with SHA-256.
- Account protection: optional two-step verification (TOTP).
- Restore control: restore is controlled separately from backup. Organizations also have Emergency Stop.
What this means in plain words: Tornova encrypts your data on its way to the cloud and in storage, and protects access with account and device controls. Tornova does not claim that only you can read your files, and it does not offer end-to-end or zero-knowledge encryption today. If your data must stay unreadable even to the service provider, Tornova's current version is not the right tool for that requirement, and you should encrypt those particular files yourself before backing them up.
The security page and the FAQ describe these controls as published.
A checklist for judging any backup provider
- Is it encrypted in transit, and which TLS version? Look for TLS 1.2 or later.
- Is it encrypted at rest? Ask whether storage is encrypted and where it is held.
- Is there client-side encryption, and is it optional or mandatory? Read what happens if you lose the key.
- Who holds the keys? If the provider manages them, they can in principle be accessed by the provider.
- How is access to storage controlled? Public or anonymous access should not exist; look for short-lived, authorised access.
- How is your account protected? Two-step verification should be available, and restores should be controllable.
- Where is the data stored, and under which country's laws? This matters for some businesses and professions.
- What does the provider say it cannot do? A provider that is honest about limits, planned features and current gaps is easier to trust than one that promises everything.
- Can you restore a real file? Security that you cannot test for yourself is a promise, not a feature.
The wider buyer's guide is in How to choose backup software. For habits that protect your files outside the backup, read How to protect important files on Windows.
Frequently asked questions
Is my Tornova backup encrypted?
Yes, in transit (TLS 1.2 or later) and at rest in cloud storage. Client-side encryption is planned but not available today.
Can Tornova read my files?
Tornova does not claim that only you can read your files. Today's encryption protects data in transit and at rest and relies on access controls, but it is not client-side or zero-knowledge encryption.
What is the difference between end-to-end and at-rest encryption?
At-rest encryption protects stored data, with keys managed by the service. End-to-end or client-side encryption scrambles data on your PC with a key only you hold, so the provider cannot read it.
Does a padlock or HTTPS mean my backup is private?
It means the connection is encrypted in transit. It says nothing about how data is stored or who can read it afterwards.
What if I need my files unreadable even to the provider?
Use a provider that offers real client-side encryption, or encrypt the files yourself before they are backed up. Keep the key safe, because nobody can recover it for you.
Keep reading
JavaScript is needed to sign in, buy a plan or use the dashboard.