This article is also available in:

How secure are Modular DS backups

Is it safe to store your backups, and your clients' backups, in an external tool? It's a fair question when you manage sites in production and recovering an entire project depends on those copies.

A backup contains the full website, its files and its database, so it can include personal data belonging to your client's end users.

At Modular DS we treat it accordingly: backups are encrypted both in transit and at rest, and they can only be accessed through our permission system.

Encryption in transit

When a backup is created, the file is encrypted while it travels. The transfer happens over HTTPS, so the data stays protected along the entire route from your server to storage.

To move the file, Modular DS generates a short-lived presigned URL, valid for only five minutes, that uploads the backup directly from your web server to AWS S3 (Amazon Web Services).

This has an important consequence: your backups never pass through Modular DS servers. The file goes straight from your site to encrypted storage, with no intermediate stops.

Encryption at rest

Once stored, backups remain encrypted. Server-side encryption is applied with rotating keys managed by AWS S3, so the stored copies are never exposed as readable text.

Where your backups are stored

Your backups are stored on AWS cloud infrastructure, and you can choose the region where they're stored from Ireland, N. Virginia (USA) and Singapore. You can even assign a different region to each site's backups.

Who can access your backups

Access to stored backups is restricted across several layers:

Private storage. Backups are kept in a fully private AWS S3 bucket with no public access. There's no direct URL to a backup, so there's no way to reach one without going through our permission system.
Access only through temporary links. To download or restore a backup, our API generates a presigned read link that is temporary and expires. There are no permanent or public links to the files.
Per-user and per-site permissions. That link is only generated for an authenticated user with permissions for the site in question. No one can request or download backups for sites they don't have access to.
Restricted internal access. On our side, direct access to storage is limited to a small, designated group from our development team, through SSO. It's not general team access.

What happens when you delete a backup

When you delete a backup, it is permanently removed from storage. Deletion can take up to 72 hours to complete. After that point, the copy no longer exists in our systems.

Your account security matters too

Since access to a backup is only granted to authenticated users with permissions, protecting your account is part of keeping your backups secure. A well-protected account is the first barrier against unwanted access.

That's why we recommend enabling 2FA login on your account, especially if you manage client sites.

If you need to formalize the processing of personal data, we have a Data Processing Agreement (DPA) available on request.

To request it, or for any more detailed security review, email us at help@modulards.com and we'll help you.

Do you need help with anything else? Email us at help@modulards.com or contact us via the support chat, and we'll be happy to help you.

Updated on: 16/09/2026

Was this article helpful?

Thank you!