How is my data backed up?

Your data lives in four separate places, all off-site, all encrypted at rest. If you use a desktop app, there’s a fifth copy sitting on your own hard drive.

Losing your notes is the one failure a second brain isn’t allowed to have. It’s the thing we engineered first, before features.

The four copies

1 and 2 — two live replicas. Your live data is replicated continuously to two different off-site servers. These are always current, always ready. If a machine dies, another one already has everything.

3 — three months of point-in-time recovery. A third off-site location, in cold storage, holds a rolling three-month point-in-time archive. That’s stronger than a nightly snapshot: we can rewind your data to a specific moment inside that window, not just to the last time somebody took a backup.

4 — a copy of that archive, colder still. The point-in-time archive is itself replicated to a fourth off-site location, colder than the third. It’s the copy that exists for the day the other three have a very bad day together.

So when something breaks, we’re not hoping a backup worked. There are four independent places to recover from, in different locations, and no single failure — a bad disk, a bad server, a bad data centre — takes out more than one of them.

Everything is encrypted at rest

Every one of those copies is encrypted at rest. Not just the live database — the replicas, the point-in-time archive, and the cold copy of the archive too. A backup is only as private as the place it’s sitting in, so we don’t treat backups as a lesser class of storage.

That’s the baseline that protects everything, always. On top of it, you can encrypt individual notes or notebooks with your own passphrase — and because we never hold that key, those notes are unreadable to us in every one of those four copies, exactly as they are in the live app.

Your own devices are another copy

If you use the Mac or Windows app, your notes are also sitting in a real database on your own machine — that’s what makes offline mode work. It isn’t designed to be opened by hand, and it isn’t a substitute for an export. But in a genuine emergency, it’s a real copy of your library on hardware you own, and we’d rather you knew it was there than found out too late.

Worth knowing: your devices carry what you need, not necessarily every large attachment you’ve never opened. More on that here.

Keep your own copy anyway

We back your data up thoroughly, and we still think you should hold a copy yourself. Not because we expect to fail — because a library this important deserves a copy that doesn’t depend on any one company continuing to exist.

Export your whole account any time, as HTML or Evernote ENEX. There’s no fee, no throttle, and no state in which export stops working — not even if your subscription lapses. Put it somewhere of your own choosing. If you’d like that to happen automatically, the harbor command-line tool covers the whole API, so a scheduled job can pull a regular copy without you thinking about it.

A notes company that encourages you to keep your own backup is telling you something about how it plans to behave.

The one gap, stated plainly

There is a single scenario where you could lose data, and we’d rather name it than let you discover it.

If several things fail at the same time in a specific way, you could lose the last minute or so of writes. That’s the whole exposure: the most recent minute, in an unusual simultaneous-failure case. Not your library, not a notebook, not a day’s work.

We’re not happy with it. We’re working on engineering a zero-loss window, but the trade-offs required to close that last minute today aren’t reasonable ones — they’d cost every user real speed, every day, to insure against a rare event. That’s the wrong bargain right now, and we’ll revisit it as the tooling improves.

Outside of that one case, there is no path in Harbor’s design that loses your data.

Backups cover our mistakes — these cover yours

Server backups are for infrastructure failures. The more common way people lose work is ordinary human error, and that’s handled separately, by you, without ever calling support:

• Version history — every note keeps one, and reverting is one click.
• Trash — deleted notes sit there until you restore them or empty it.
• Conflict copies — edit the same note on two offline devices and Harbor keeps both rather than silently picking a winner.

Details in Can I restore an old version of a note? — including the one action that genuinely can’t be undone.

Still worried about something specific? Ask us. A real person answers.