Knowledge base · Storage & destinations

Backing up Storage buckets

How Storage sync works, which keys it needs, why it is incremental, and how objects are encrypted.

Your users' files live in Supabase Storage, not in Postgres, so a database backup doesn't include them. Storage sync (Pro and Team) backs them up alongside.

Setup

1. In the Supabase dashboard go to Storage → S3 access keys and create a key pair just for VaultKeep, so you can revoke it independently.
2. In VaultKeep, open the project → Credentials → Storage S3 keys, paste the access key id and secret, and pick the project's region (shown under Storage → S3 connection; if you pick the wrong one, validation detects and corrects it).
3. Under Schedule, turn on Storage buckets.

How a sync works

• Every bucket is listed and every object inventoried (name, size, ETag).
• Objects that are unchanged since the previous sync (same ETag and size) are reused: their entry, including the key that encrypted them, is carried into the new manifest. Nothing is transferred.
• Changed and new objects are streamed from Supabase through AES-256-GCM into your backup destination, one encrypted object each.
• A manifest listing every object, its hash and its wrapped key is written with the backup.

So a nightly sync of a 50 GB bucket where 100 MB changed moves 100 MB.

Retention

Each Storage backup is retained like a database backup. When one expires, only objects no newer manifest references are deleted, so reused objects survive as long as any retained manifest needs them.

Restoring files

See Restoring a backup into a new project: buckets are recreated and every object is streamed back, decrypted.

Limits

• Public/private settings and per-bucket file-size or MIME limits are recreated as private buckets with default settings on restore; adjust them afterwards.
• Storage RLS policies live in the database (storage.objects policies) and are restored with it.
• Very large buckets (millions of objects) work but take time; the first sync is the slow one.

Still stuck? Email support@vaultkeep.dev with your project name (never your connection string) and we'll take a look.