Backups you host.
Data you own.
Holdfast Backup protects every machine in your fleet with lightweight mTLS-enrolled agents, deduplicated storage, and restore your users can run themselves — all on infrastructure you control.
Agents
One lightweight agent, every machine
A single agent runs as a Windows service or a Linux systemd unit. Each one enrolls with the server over mutual-TLS, presenting a client certificate signed by your own internal certificate authority — so only machines you approve can ever connect.
- Windows + Linux, installed in minutes
- Mutual-TLS with per-agent certificates
- Enrollment gated by token, IP allowlist, and server-identity pinning
Storage
Deduplicated storage that stays small
Data is split into content-addressed chunks, so identical blocks are stored once no matter how many machines or versions share them. Keep blobs on local disk for speed, or point them at any S3-compatible object store for cheap, scalable capacity.
- Content-addressed, deduplicated blocks
- Local disk or S3-compatible object storage
- Move the default destination without downtime
Schedules & retention
Back up on your cadence, keep exactly what you need
Define per-set schedules and retention rules — keep the last N versions, everything within an age window, or a custom policy. Need a copy right now? Run a backup on demand from the console or the agent tray.
- Per-backup-set schedules
- Retention by count, age, or custom rule
- On-demand "run now" from console or tray
Self-service restore
Users restore their own files — within your rules
The end-user portal and agent tray let people browse their backup history and restore what they need, without opening a ticket. Every self-service action is bounded by tenant policy and per-device overrides, so you decide exactly what each person can do.
- Browse and restore from retained history
- Bounded by tenant policy + per-device overrides
- Devices owned by people, with clear transition when hardware changes
Fleet operations
Update and watch the whole fleet from one place
Roll agent updates out from the console and let the fleet update itself — no touching each machine. Alerts reach you by email or webhook, and every event can stream to your SIEM as RFC 5424 syslog.
- Self-updating agents, rolled out centrally
- Email + webhook alerting
- RFC 5424 syslog to your SIEM, per tenant
Multi-tenant
Built for many clients, sites, or teams
Isolate customers, locations, or departments as tenants — each with its own policies, limits, and branding. Set per-person storage, device, bandwidth, and retention limits, and let each tenant look like their own product.
- Strong tenant isolation
- Per-person storage / device / bandwidth / retention limits
- Per-tenant branding and onboarding
Security posture
Protected before the first byte moves
Every connection is mutually authenticated with certificates from your own internal CA. Enrollment is gated by single-use tokens, per-tenant IP allowlists, and server-identity pinning — and agents can be resource- limited so backup never starves a production box.
Bring your fleet under protection you control
Stand up Holdfast Backup on your own hardware or cloud and enroll your first agent today.