PRIVATE ARCHIVE prod / latest ALL SYSTEMS NOMINAL UTC

Encrypted offsite backups, instrumented end-to-end.

Restic-encrypted ciphertext over Tor. Monero settlement. SHA-anchored audit trail. Zero PII collected, by design.

$ download client read specs →
Ciphertext blobs in-flight (p99)38ms▼ 4ms vs 7d
Active encrypted snapshots14.2kstable
Tor circuit RTT (p50)412ms▲ 18ms
Ingest backlog0qdrained

System architecture

   ╔════════════╗  Tor  ╔═════════════════╗
   ║  client    ║─ 3h ──║   service       ║
   ║  + Restic  ║◄──────║   ciphertext    ║
   ╚════════════╝       ╚═════════════════╝
       │                         │
       │ AES-256-GCM              │ ciphertext only
       │ keys: client-side        │ no plaintext, ever
       │ service holds no keys    │ no decryption path

Client-side AES-256-GCM via Restic. The service receives ciphertext only; where bytes physically reside is not a relevant security parameter because the service has no decryption keys.

Tariff

RateXMRpay-as-you-go

Burns down by the second. No subscription, no commit.

Privacy commitments

  • No name / email / phone collected
  • No IP visible (Tor)
  • No payment trail (Monero)
  • No file content or metadata
  • No analytics, including this page
  • Cert hash[:8] retained in logs

Throughput (rolling 30d, anonymised)

30d ago p50 ingest now

Threat coverage

Network observerPASS
Server compromisePASS
Disk seizurePASS
Insider with admin accessPASS
Lost client certFAIL — by design
Lost passphraseFAIL — by design

Distribution

OSArchFormatArtifactSHA256 (12)
macOSarm64.tar.gzprivatearchive-darwin-arm64.tar.gz…
macOSamd64.tar.gzprivatearchive-darwin-amd64.tar.gz…
Linuxamd64.tar.gzprivatearchive-linux-amd64.tar.gz2c17e9f30de4…
Linuxarm64.tar.gzprivatearchive-linux-arm64.tar.gz9a4b6d827c11…
Windowsamd64.zipprivatearchive-windows-amd64.zip71fe8c2b094a…
Windowsarm64.zipprivatearchive-windows-arm64.zip…
FreeBSDamd64.tar.gzprivatearchive-freebsd-amd64.tar.gz…
FreeBSDarm64.tar.gzprivatearchive-freebsd-arm64.tar.gz…
OpenBSDamd64.tar.gzprivatearchive-openbsd-amd64.tar.gz…
OpenBSDarm64.tar.gzprivatearchive-openbsd-arm64.tar.gz…
Sourceany.tar.gzSource · privatearchive-source.tar.gz · verify the cryptod4e7a91c5b03…

Full SHA256SUMS · all builds reproducible from source tarball

Install & keep up to date

Every channel below installs the same reproducible, signed binaries. Verify direct downloads against SHA256SUMS; the apt and dnf repositories are GPG repo-signed with fingerprint 4792 23EA 8405 287A 11FB B12E 02A7 7A1E EDD0 F111.

Any platform — one line

curl -fsSL https://privatearchive.xyz/install.sh | bash

Or download a tarball for macOS, Linux, Windows, FreeBSD or OpenBSD (amd64 + arm64) — and the source — from the latest release.

Debian / Ubuntu — apt

curl -fsSL https://privatearchive.xyz/apt/release-key.asc | sudo gpg --dearmor -o /usr/share/keyrings/privatearchive.gpg
echo "deb [signed-by=/usr/share/keyrings/privatearchive.gpg] https://privatearchive.xyz/apt stable main" | sudo tee /etc/apt/sources.list.d/privatearchive.list
sudo apt update && sudo apt install privatebackup

Fedora / RHEL — dnf

sudo curl -fsSL https://privatearchive.xyz/dnf/privatearchive.repo -o /etc/yum.repos.d/privatearchive.repo
sudo dnf install privatebackup

Arch — bootstrap script

curl -fsSL https://privatearchive.xyz/install.sh | bash

macOS — Homebrew

brew install https://privatearchive.xyz/brew/privatebackup.rb

Windows — Scoop

scoop install https://privatearchive.xyz/scoop/privatebackup.json

Docker — maximum anonymity (over Tor)

Pull and run the all-in-one client from our self-hosted registry, reachable only as a Tor v3 onion service — no account, no third-party registry, and no IP logged on either side.

1. Install Tor (gives you a SOCKS proxy on 127.0.0.1:9050): sudo apt install tor · sudo dnf install tor · sudo pacman -S tor, then sudo systemctl enable --now tor.

2. Point the Docker daemon at Tor and allow the onion (HTTP) registry — add to /etc/docker/daemon.json:

{
  "insecure-registries": ["no2kzx2qaqnl5zc7yuegtsgydv3wes377l6hxpdx36yzdwh6nmtsepad.onion"],
  "proxies": { "http-proxy": "socks5://127.0.0.1:9050", "https-proxy": "socks5://127.0.0.1:9050" }
}

then sudo systemctl restart docker.

3. Pull and run:

docker pull no2kzx2qaqnl5zc7yuegtsgydv3wes377l6hxpdx36yzdwh6nmtsepad.onion/privatearchive-client:latest
docker run -p 62774:62774 -v pa-data:/var/lib/private-archive \
  no2kzx2qaqnl5zc7yuegtsgydv3wes377l6hxpdx36yzdwh6nmtsepad.onion/privatearchive-client:latest

Web UI at http://127.0.0.1:62774; Tor is bundled inside the image. This routes the Docker daemon through Tor while configured — revert daemon.json or add a no-proxy list for your other registries afterward.