Back up your Cloudflare. We never hold the backups.
downpipes is no-custody backup and disaster recovery for the Cloudflare data layer. It runs inside your own Cloudflare account, seals every archive with post-quantum encryption under keys only you hold, and writes to storage you control. We never see your data.
The problem
Your Workers KV, D1, R2, Secrets Store, and account configuration are the backbone of your product. Cloudflare's native backup story is thin, and the usual fix is to hand a third-party SaaS standing access to your account so it can copy your data onto its servers.
Now your disaster-recovery vendor is itself a breach target, holding a copy of everything and a key into your account. The thing meant to protect you becomes the thing most worth attacking.
Our approach
downpipes never takes custody. The backup engine is a routeless Cloudflare Worker you deploy into your own tenant. It reads your data, seals it with post-quantum hybrid encryption under keys you generate and hold, and writes the archives to destinations you control.
Maelstrom never sees your data, never holds your keys, and keeps no standing path into your account. There is nothing on our side to breach, subpoena, or leak.
Runs in your account. Sealed under your keys.
1. Deploy in your account
The engine is a routeless Cloudflare Worker that runs inside your own tenant. No public route, no inbound path. It reads your sources on a schedule you set.
2. Sealed under your keys
Every archive is sealed with post-quantum hybrid encryption. You generate the keys in a guided in-browser ceremony and store them offline. We never receive them.
3. 3-2-1 fan-out
Each source is written to two or more independent destinations you control. Workers KV, D1, R2, Secrets Store, and 214 zone and account configuration surfaces.
4. Proven recovery
Hourly canary integrity flights and scheduled in-account restore drills continuously prove your backups actually restore. Signed reports give you the evidence.
Who holds what
No party other than you ever holds your data or the keys to open it.
| Party | Holds | Never holds |
|---|---|---|
| You (the customer) | Your data, your encryption keys, your backup destinations | — |
| Maelstrom AI (vendor) | The software, a signed update channel, a licence token, a content-free advisory beacon | Your keys, your data, your Cloudflare tokens |
| Cloudflare | The edge compute and storage your engine runs on | Your plaintext (every archive is sealed before it lands) |
Even Maelstrom disappearing cannot lock you out. The MIT-licensed downpipe offline reader restores from archive bytes plus your key alone, with no vendor and no network, built from a frozen public format specification. Your last-resort recovery path is fully open and forkable.
What ships
| Component | Role |
|---|---|
| engine | In-tenant backup Worker. Reads, seals, fans out. Runs in your account. |
| console | Operator console for configuration, restore approvals, posture, and reports. |
| control-plane | Vendor-side licence tokens and a content-free advisory beacon. Holds no keys or data. |
| downpipe | MIT offline reader. Restores from archive bytes plus your key, no vendor, no network. |
| update channel | Static, signature-pinned R2 bucket. The engine verifies and pulls; it is never pushed to. |
Updates are pull-only and signature-pinned: the engine verifies each update against a pinned public key before applying, settles it behind a canary integrity flight, and rolls back automatically if the canary fails. No phone-home.
The licence is fail-open by design. A missing, expired, or forged licence degrades to the free tier; it never gates backup or restore. The control-plane holds no customer keys, data, or Cloudflare tokens, so its compromise cannot read a single archive.
Observability by consent, never a back door
downpipes runs dark: no telemetry by default and no standing vendor access. The no-inbound property is exactly what you are paying for.
When you want help, you mint a time-boxed, scoped, immediately-revocable read-only credential and send a redaction-safe, signed support bundle. We can diagnose an issue without a permanent path into your account and without your data ever leaving it.
- Scored security posture with regression alerts
- Hourly canary integrity flights
- Notification rules that page your operator on failure
- Owner-minted, revocable, read-only diagnostic access
- We dogfood it: Maelstrom's entire Cloudflare estate is backed up by our own production instance of downpipes
Source-available, and free to run yourself
downpipes is source-available under the Elastic License v2. You are free to read it, run it yourself in your own Cloudflare account, and rely on it, for free. The one thing the licence does not allow is reselling downpipes as a managed service to others.
That restriction is not commercial protection; it is the product. A third party running downpipes for you would be taking custody of your backups, and no-custody is the entire point. The downpipe offline reader is MIT-licensed, so your recovery path is fully open.
- Engine, console, control-plane: source-available (Elastic License v2)
- Offline reader: open source (MIT)
- Free to self-host, no licence required to back up or restore
- Paid enterprise support available
Being prepared for general availability
downpipes is being readied for launch. It is source-available today, and enterprise support is available now for teams that want help standing it up in their Cloudflare estate.