Security best practices

CapyArk's architecture does a lot for you — private networking, tenant isolation, restricted SSH, encrypted storage. This page covers the part only you can do: securing your side of the connection.

What CapyArk already handles

So you know where your responsibility starts, here’s what’s built in:

• No public exposure — your storage node is reachable only inside your private Tailscale network. There is no public SSH port to brute-force.
• Tenant isolation — every customer gets an isolated dataset and an isolated VPN network with its own access rules. Other tenants can’t see your node.
• Restricted SSH — no interactive shell, no port forwarding; only file-transfer commands (rsync, sftp, zfs) are allowed, and every session is audit-logged.
• Encryption at rest — datasets are encrypted with per-tenant keys.

1. Use SSH keys instead of passwords

Passwords can be guessed, reused, and phished; keys can’t. Generate a modern key and add the public half in the portal:

ssh-keygen -t ed25519 -f ~/.ssh/capyark -C "backup@my-machine"

Add the contents of ~/.ssh/capyark.pub in Settings → SSH Keys, then tell SSH to use it in ~/.ssh/config:

Host storage-baas_xxxxx
    IdentityFile ~/.ssh/capyark
    User your-username

For unattended backup jobs (cron, scheduled tasks), keys are not just safer — they’re the only sane option, since you can’t type a password at 2 AM.

2. Turn on two-factor authentication

Two minutes, biggest single win. Full walkthrough: Enable two-factor authentication.

3. One device, one identity

Add each machine to your network as its own device with a recognizable hostname instead of sharing one identity. This gives you:

• A device list in the portal that actually means something — you can spot a device you don’t recognize.
• The ability to remove exactly one machine (a stolen laptop, a decommissioned server) without touching the others.

Audit the Connect tab occasionally and remove devices you no longer use.

4. Protect against ransomware with snapshots

CapyArk’s automatic snapshots are immutable history — a compromised client machine that deletes or encrypts the files in your dataset cannot alter the snapshots that were taken before the compromise.

To get the full benefit:

• Know your plan’s retention window (daily and weekly snapshot counts). Detection of a breach often takes days — retention is your time budget.
• Don’t point your backup tooling’s own “cleanup” at data it didn’t create.
• If you suspect a compromise, contact support immediately — snapshots can be protected from expiry while you investigate.

5. Set a personal storage cap

In Storage you can set a self-cap below your plan’s ceiling. Besides making costs predictable, it limits blast radius: a runaway (or malicious) process on a client machine can’t balloon your usage past the cap.

6. Watch your notifications

Enable failure and quota alerts in Settings → Notifications. A backup that silently stopped weeks ago is the most common disaster-recovery failure in the industry — the alert email is boring right up until it saves you.

7. Test your restores

An untested backup is a hope, not a backup. Quarterly at minimum:

1. Pick a random file or directory.
2. Restore it from a snapshot following Restore from a snapshot.
3. Verify the contents match what you expect.

Put it in your calendar. Fifteen minutes, four times a year.

Reporting a vulnerability

Found a security issue in CapyArk? Email support@capyark.com with the details. We take reports seriously and respond quickly — please give us a reasonable window to fix the issue before public disclosure.