v0.1 // ENCRYPTED OFFSITE PROTOCOL

STORE / ROUTE / PAY

Backups nobody can read — not us, not your ISP, not anyone who breaks in, not a future owner of this company.

      > archive.init --cert ./your.pem
      > archive.fund --xmr 0.05
      > archive.push ~/.life
      [OK] encrypted. routed. forgotten.
    

[ DOWNLOAD ] [ READ THE PROTOCOL ]

// PROTOCOL_LAYERS

Stacked privacy. Each layer fails closed.

RESTIC // crypt

AES-256 + Poly1305 client-side. Keys never leave your device. The blob is encrypted on your machine. Server only ever holds opaque ciphertext — wherever the operator parks the bits is irrelevant, they cannot decrypt them.

TOR // ghost

Onion-routed transport. Three hops between you and us. Origin IP unknowable on both sides.

mTLS // ident

Your client cert is your account. SHA256 of the cert is your only ID. No password, no email, no recovery flow. Lose the cert, lose the archive.

XMR // settle

Pay-as-you-go in Monero. Balance burns down as you push bytes. Top up when needed. No subscription, no invoice trail. Subaddress per client, stealth addresses, ring signatures — the chain forgets who paid.

// THREAT_VECTORS

What we are designed to survive.

VECTOR	STATUS
Network observer (ISP / transit)	CONTAINED — tor + tls
Server compromise	CONTAINED — ciphertext only
Disk seizure	CONTAINED — opaque blobs, no keys
Insider with admin access	CONTAINED — no keys, no plaintext, no PII to leak
Loss of your client cert	FATAL — archive lost
Loss of your passphrase	FATAL — data lost

// DEPLOY

JACK_IN.

Open source. Reproducible builds. Zero PII, zero analytics, zero phone-home.

macOS arm64 · Apple Silicon .tar.gz macOS amd64 · Intel .tar.gz Linux amd64 .tar.gz Linux arm64 .tar.gz Windows amd64 .zip Windows arm64 .zip FreeBSD amd64 .tar.gz FreeBSD arm64 .tar.gz OpenBSD amd64 .tar.gz OpenBSD arm64 .tar.gz SOURCE audit the crypto .tar.gz verify SHA256 SUMS

Install & keep up to date

Every channel below installs the same reproducible, signed binaries. Verify direct downloads against SHA256SUMS; the apt and dnf repositories are GPG repo-signed with fingerprint 4792 23EA 8405 287A 11FB B12E 02A7 7A1E EDD0 F111.

Any platform — one line

curl -fsSL https://privatearchive.xyz/install.sh | bash

Or download a tarball for macOS, Linux, Windows, FreeBSD or OpenBSD (amd64 + arm64) — and the source — from the latest release.

Debian / Ubuntu — apt

curl -fsSL https://privatearchive.xyz/apt/release-key.asc | sudo gpg --dearmor -o /usr/share/keyrings/privatearchive.gpg
echo "deb [signed-by=/usr/share/keyrings/privatearchive.gpg] https://privatearchive.xyz/apt stable main" | sudo tee /etc/apt/sources.list.d/privatearchive.list
sudo apt update && sudo apt install privatebackup

Fedora / RHEL — dnf

sudo curl -fsSL https://privatearchive.xyz/dnf/privatearchive.repo -o /etc/yum.repos.d/privatearchive.repo
sudo dnf install privatebackup

Arch — bootstrap script

curl -fsSL https://privatearchive.xyz/install.sh | bash

macOS — Homebrew

brew install https://privatearchive.xyz/brew/privatebackup.rb

Windows — Scoop

scoop install https://privatearchive.xyz/scoop/privatebackup.json

Docker — maximum anonymity (over Tor)

Pull and run the all-in-one client from our self-hosted registry, reachable only as a Tor v3 onion service — no account, no third-party registry, and no IP logged on either side.

1. Install Tor (gives you a SOCKS proxy on 127.0.0.1:9050): sudo apt install tor · sudo dnf install tor · sudo pacman -S tor, then sudo systemctl enable --now tor.

2. Point the Docker daemon at Tor and allow the onion (HTTP) registry — add to /etc/docker/daemon.json:

{
  "insecure-registries": ["no2kzx2qaqnl5zc7yuegtsgydv3wes377l6hxpdx36yzdwh6nmtsepad.onion"],
  "proxies": { "http-proxy": "socks5://127.0.0.1:9050", "https-proxy": "socks5://127.0.0.1:9050" }
}

then sudo systemctl restart docker.

3. Pull and run:

docker pull no2kzx2qaqnl5zc7yuegtsgydv3wes377l6hxpdx36yzdwh6nmtsepad.onion/privatearchive-client:latest
docker run -p 62774:62774 -v pa-data:/var/lib/private-archive \
  no2kzx2qaqnl5zc7yuegtsgydv3wes377l6hxpdx36yzdwh6nmtsepad.onion/privatearchive-client:latest

Web UI at http://127.0.0.1:62774; Tor is bundled inside the image. This routes the Docker daemon through Tor while configured — revert daemon.json or add a no-proxy list for your other registries afterward.