Encrypted before it leaves the database
Every nightly dump is encrypted with age (AES-256) at the source, using a public key the server only knows how to write with. The matching private key never touches the production machine.
- pg_dump custom format, compressed
- age public-key recipient model
- plaintext exists only in memory on restore