Backups
Your vaults are copied automatically every night. Restoring always creates a new vault beside your existing ones — it never replaces them.
Every night at 02:00, PulsVault takes a snapshot of your vaults and keeps it for as long as your plan allows. This happens automatically; there is nothing to switch on.
Find them under App settings → Backups, newest first, with when each was taken, how many vaults and items it holds, and its size. You can also take one yourself at any time.
If you have no backups yet the page says No backups to show yet: if you signed up today, your first nightly one has not run, and Back up now takes one straight away.
If your vault is locked#
The list is read with your vault key, so while your vault is locked the page shows Your vault is locked with an Unlock vault button instead of an error. Nothing is wrong — your backups keep being taken on schedule in the meantime. Unlock your vault with your Access Key and the list appears. A failed load, by contrast, shows We could not load your backups just now and Try again.
Backups belong to your organization there, so this screen is not part of those plans. Your vaults are still backed up every night; an administrator takes extra backups and restores organization vaults from Organization → Vault backups — see Vault backups.
What a snapshot contains#
Your vaults, their items, their attachments, and who they are shared with — plus the wrapped keys that let you open them. Your secrets are encrypted on your device before they ever reach us, so nobody at PulsVault can read them out of a backup, and no support process can.
That is also why we cannot hand you a readable backup file from our side. If you want a copy you can open yourself, export it from your device.
On the Enterprise plan, an organization can also receive a nightly backup archive: its whole configuration, DevOps secrets, company vaults and audit log, encrypted to keys only it holds and delivered to its own storage bucket — a copy it can open without PulsVault.
A backup covers your vaults. Secrets stored in DevOps Secrets are a separate system with its own versioning, and they are not part of these snapshots.
Taking a backup now#
About to make a big change — a bulk edit, an import, a clean-up? Choose Back up now (it reads Backing up… while it works) under App settings → Backups first. The snapshot is taken straight away and appears at the top of the list marked Manual. It holds exactly what a nightly snapshot holds, is kept for the same window, and restores the same way.
Every snapshot is a full copy of your vaults kept for your whole window, so there are two limits:
- one every 10 minutes, and
- no more than 10 in any 24 hours.
If you reach either, the screen says so and tells you when the next one is allowed. Nightly snapshots never count toward these limits and keep running as usual.
If your plan lapses and your account becomes read-only, Back up now, restoring and changing your retention window are paused until it is active again. Your vaults are still backed up every night. To take a copy away with you, export your vaults — see Keeping your own copy.
How long snapshots are kept#
| Plan | Snapshots kept |
|---|---|
| Free | 7 days |
| Premium · Developer · Family · Team | 30 days |
| Business | 90 days |
| Enterprise | 180 days |
Snapshots older than your window are deleted automatically each night, along with the stored data they point at. Backup windows are shorter than audit-log retention on purpose: a snapshot is a copy of every vault you hold, not a line in a log.
Keeping them for less time#
The table above is a ceiling, not a fixed number. Under App settings → Backups you can shorten your own window to anything from one day up to your plan's limit — useful if you would rather not have copies of your vaults sitting around for three months.
You cannot lengthen it past your plan. The audit log's retention can be extended beyond its plan, and backups deliberately cannot: an audit entry is a line, a snapshot is a copy of everything you hold, and a longer window would be storage nobody quoted you for.
Shortening it takes effect on the next nightly run, which deletes anything already past the new window. If your plan later changes, your choice is kept: a downgrade narrows what is in force without overwriting the number you set, and an upgrade brings it back.
On a Family plan, each person sets their own window for the vaults they own, within the plan's limit. The family organizer does not set it for everyone.
What restoring does#
Choose Restore on a backup and pick the vaults you want back — all of them are selected to start with. Each one comes back as a new vault beside your existing one, named for the night it is from, for example Marketing (restored from 20 Sep 2026). If you already have a vault with that name, the new one gets a number: … (restored from 20 Sep 2026) 2. It never overwrites anything.
Restoring into one of your existing vaults is not possible, on purpose — here is why.
That is a deliberate safety property, not a limitation. Your vault key can change after a snapshot is taken — this happens when you remove someone's access — and writing old data back over a live vault could make those items permanently unreadable, with nothing on our side able to detect it, because we cannot read either version. Restoring into a separate vault means both open correctly and you move across whatever you need.
Sharing is restored too, but only for people who still have access today, at whatever level they have now. Someone whose access you removed will not get it back through a restore — and the confirm step tells you exactly who, by name, before you commit.
Attachments are restored by pointing at the file we already hold, so restoring never uses extra storage against your plan. If an attachment was deleted longer ago than your backup window, its contents are gone and cannot come back; the restore names those files rather than failing.
The result#
When a restore finishes, a Restore complete panel stays on the page — a panel rather than a passing message, because this is the moment you need to know what did not come back. It lists how many items were restored, how many attachments were re-attached and how many people kept their access, with an Open link for each new vault. If anyone did not get access back, or an attachment could not be restored, expandable lines name each person and file. Select Dismiss when you have read it.
If a restore is refused#
| What you see | What it means |
|---|---|
| This backup cannot be restored | Its stored data is damaged or has expired. Try the backup taken before it. |
| This backup cannot be read | It was taken by a newer version of PulsVault. Contact support. |
| Not enough room on your plan | Restoring would add more vaults than your plan allows. Delete a vault or upgrade, then try again. |
| Your vault is locked | Unlock it with your Access Key, then try again. |
| This backup no longer exists | It aged out of your plan's window while the page was open. Reload to see your current backups. |
Keeping your own copy#
- Export your vault from the vault menu. The file is encrypted before it leaves your device.
- Connect Google Drive under App settings → Cloud Storage, and upload that export.
- Keep the export's password or recovery material somewhere separate from the file itself.
It holds the same encrypted material we do. Anyone who obtains both the file and the key material has your data — store them apart, and treat a stale export as something to delete rather than keep.