Problem
Ploi backups are currently written to the storage provider unencrypted. Whoever controls that bucket can read database dumps and site files in full: credentials in .env, customer data, everything.
For anyone under GDPR that effectively rules out US-based storage providers, no matter how good the product is. Backblaze B2 is the obvious example: cheap, fast, well integrated, but as a US company it falls under the CLOUD Act, so unencrypted personal data landing there is a compliance problem I can't argue away. Same story for S3, Wasabi, and DigitalOcean Spaces. The result is that provider choice gets decided by jurisdiction instead of by price, performance, or region, and the cheaper options in the Ploi UI are unusable for a large part of the EU customer base.
Provider-side encryption (SSE) does not solve this either. The provider still holds the key, so it changes nothing legally.
Request
Encrypt backup archives client-side, on the server, before upload. Two key modes:
Ploi-managed key: generated per team or per server, stored by Ploi, used transparently. One checkbox, works for the majority of users, restores keep working through the panel exactly as they do now.
Customer-managed key: I supply a passphrase or public key. Ploi encrypts with it and never stores the secret. Restores through the panel then require me to paste the key, and Ploi shows a clear "lose this key and the backup is gone" warning at setup.
Nice to have:
- Per-server or per-backup-config toggle rather than global only
- Key rotation without invalidating existing archives (encrypt to the new recipient going forward, keep old recipients valid for old archives)
- A documented CLI command to decrypt an archive outside of Ploi, so backups stay restorable if Ploi is unreachable
- Encryption status visible in the backup list so you can see at a glance which archives are protected
Why this is worth building
It turns "which providers are legally safe" into "which providers are cheapest and fastest", which is a real unlock for every EU customer, and it makes zero-knowledge backups a genuine differentiator against Forge and RunCloud, neither of which offers this today as far as i know.
