Skip to content
Open Net Worth Docs

Backup and restore

What a backup contains

A complete, point-in-time snapshot of everything this instance stores: your full ledger, every setting, and every credential on the box (login, connector keys/tokens, AI provider key). Different from export and portability, which carries a curated, credential-free slice of your data to another instance rather than recovering this one.

When it runs

Automatically, once a day. Trigger one on demand from Settings → Data (“Back up now”), or with make backup. Same screen: turn the daily backup off, set how many days to keep — older ones prune automatically.

Downloading a backup: the sanitised copy

The on-server backup is the full, unsanitised snapshot. The download is different: every credential is stripped before it leaves the server — overwritten at the byte level, not just hidden. The download response names exactly what was stripped. This is the only version of a backup that ever leaves the box, and the one to move off-site.

There’s no uploading a downloaded backup back in — restoring only ever works against a backup already in this instance’s own local folder, by name.

Restoring

Restoring always takes a fresh safety backup of the current state first, so it’s itself undoable if it turns out to be the wrong one.

Your credentials are never touched by a restore, in either direction. Whichever backup you restore, your current login password, connector credentials, AI key, permission decisions, and audit trail come back exactly as they were beforehand — nothing rolls forward or back. So a revoked permission can’t quietly return, a used approval can’t reappear, and you’re never locked out by restoring an old backup. Your ledger, settings, book data, and automation run history all change to match the backup you chose.

Because restore only runs against an on-server backup, never a downloaded sanitised one, you never re-enter credentials after restoring. The exception: provisioning a new machine from a downloaded backup — outside this flow entirely, so reconnect each connector normally afterward.

  • operations/export-and-portability — moving data (never credentials) between installs
  • operations/security-and-privacy — where every credential lives day to day
  • operations/upgrading — the automatic backup before a schema change