Scheduled drills
Nightly backup and weekly drill as background jobs that alarm loudly rather than failing into a log nobody opens.
End-to-end encrypted backup
Arcamere encrypts your files on your machine and stores them in your bucket or ours. Then it does the thing almost nobody does: every week it restores a sample of them for real, checks every byte against the hash recorded when you backed it up, and signs the result.
The part nobody checks
Backup software is judged on the day you lose something, and for most people that is the first day it is ever tested. Until then a green checkmark and a silently corrupted vault look exactly the same.
Your backup app says it ran. That tells you bytes were sent. It does not tell you they can come back, and the two are different claims that nobody separates until the day it matters.
Almost nobody has. The first real restore most people attempt is under pressure, on a machine they just replaced, with no idea whether the thing they are about to try actually works.
A backup that quietly stopped running three months ago produces exactly the same experience as one running perfectly: nothing. You find out by looking, and nobody looks.
Most consumer backup encrypts with a key the vendor can use. Where a private key is offered it is opt-in, and on some services restoring means handing that key back so they can decrypt for you.
Sync propagates deletions faithfully, which is its job. A bad script, a wrong conflict resolution or a mis-drag arrives on every device you own within seconds. The sync worked. The files are gone.
You have an AI that could find the version of a file from before an edit and put it back in one step. No backup product gives it a way in, so you browse a web restore page by hand instead.
How it works
Files are split into content-defined chunks and encrypted with AES-256-GCM under a key derived from your passphrase. Plaintext never touches the storage target, and the manifests listing what you have are encrypted too, so the bucket does not reveal the shape of your data.
Any S3-compatible storage: Cloudflare R2, Backblaze B2, Wasabi, MinIO, Amazon S3, a local disk, or network-attached storage. The service is separate from the space, so you are never renting your own data back from us.
Every week it pulls a random sample out of the vault, restores them through the same code path your recovery would use, compares each against the hash recorded at backup time, and signs the report. Tamper with a result and the signature breaks.
Your assistant can drive all of it
Arcamere ships a Model Context Protocol server with nine operations, so Claude, ChatGPT or any agent addresses the same vault your command line does. No other product in the comparison set publishes one.
The nine operations: list snapshots, read a manifest, search, restore a file, verify, run a drill, back up, read drill reports, read the health verdict. It resolves the vault through the same code path the command line uses, so an assistant and a person address the identical vault. It reads and restores; it is not a channel that uploads your files anywhere.
The restore drill
Verifying a checksum tells you the bytes you stored are the bytes you stored. It does not tell you a restore works. A drill performs the restore.
Every drill writes an HMAC-signed report recording what was sampled, what came back, every hash comparison and the verdict. Reports accumulate into a history, and the history collapses into one state you can read in a second.
That verdict separates cases most monitors conflate. A vault whose drills all passed but which stopped running reads STALE, never HEALTHY. A new vault whose first drill is not due yet reads PENDING, not FAILING, so it cannot cry wolf in week one and teach you to ignore it.
Capabilities
Everything marked built runs today and is covered by 69 tests. Everything marked planned is not written yet, and we would rather say so here than have you find out later.
Your passphrase never leaves your machine, on backup or on recovery. There is no path where we hold a key that opens your files, which means there is no path where we can be compelled to use one.
Any S3-compatible endpoint, a local disk, or network-attached storage. Your storage bill stays yours, and the vault is recoverable with nothing but the bucket coordinates and your passphrase.
Nightly backup and weekly drill as background jobs that alarm loudly rather than failing into a log nobody opens.
A nine-operation Model Context Protocol server. Nobody else in the comparison set publishes one.
Content-defined chunking with a content-addressed store: an unchanged tree costs zero new chunks.
Symlinks captured as links and never followed. Finder tags and extended attributes round-trip byte-exactly. Empty directories, directory permissions and timestamps all survive. Atomic writes, so a half-written object is never visible. Restores are guarded against path traversal.
Online-only files from Dropbox, iCloud Drive and OneDrive hold no bytes locally, and reading one downloads it. Arcamere detects them and skips them rather than silently rehydrating an entire remote drive, then tells you exactly what it skipped and how much it came to.
The engine is portable, the client is not written. Neither Backblaze nor Arq ships one either.
Same engine, a different thin shell. Not written yet.
Bring-your-own-bucket works today.
Compared
Prices and capabilities were read off each vendor's own pages on 3 August 2026 and are linked so you can confirm them. Where a competitor matches us the table says so. Every cell describes what each product does today, read from its own pages, so anyone can repeat the read.
| Capability | Arcamere | Backblaze | Arq | IDrive | Carbonite | Kopia | restic |
|---|---|---|---|---|---|---|---|
| Scheduled restore drills with a signed report | Yes | No | Validate only, and not on S3/B2 | No | No | No | No |
| Health verdict separating stale from healthy | Yes | No | No | No | No | No | No |
| Agent interface (Model Context Protocol) | Yes, nine operations | No | No | No | No | No | No |
| Reports which files it did not back up | Yes | No | No | No | No | No | No |
| Key stays on your machine during restore | Yes | No, the key is supplied to restore | Yes | No | No | Yes | Yes |
| End-to-end encryption on by default | Yes | Opt-in private key | Yes | Opt-in private key | Opt-in | Yes | Yes |
| Every default exclusion can be removed | Yes | Directory exclusions cannot be | Yes | Yes | Yes | Yes | Yes |
| Bring your own bucket | Yes | No | Yes | No | No | Yes | Yes |
| Network drives and network-attached storage | Yes | Not supported | Yes | Yes | Limited | Yes | Yes |
| Extended attributes and Finder tags round-trip | Yes | Not stated | Yes | Not stated | Not stated | Yes | Yes |
| Graphical app | Command line today | Yes | Yes | Yes | Yes | Yes | Command line |
| Price | See below | $99/yr unlimited | $49.99 once, or $59.99/yr for 5 machines | $69.99/yr, 5 TB | Subscription, see vendor | Free | Free |
Sources, all read 2026-08-03: Backblaze pricing · Backblaze on network storage · Backblaze Mac exclusions · Backblaze mobile app docs · Arq pricing · Arq "Back up and Validate" · IDrive pricing · Kopia · restic. Arq's listed prices rise to $59.99 and $69.99 on 1 September 2026. Carbonite's pricing page did not resolve on the day of the audit, so its price is left to the vendor rather than guessed. Enterprise platforms such as AWS Backup do offer automated restore testing; the claim in row one is about prosumer tools.
A distinction worth ten minutes
Dropbox, iCloud Drive, Google Drive and OneDrive are sync tools and they are good at their job: make the same files appear on several machines. That job requires them to propagate changes. When a file is deleted on one machine, sync's correct behaviour is to delete it everywhere, quickly, because that is what you asked for.
Which means the failure people actually experience is not the dramatic one. It is a script with a bug, a conflict resolved the wrong way, a folder dragged somewhere strange on a phone: and then the deletion arrives faithfully on every device you own within seconds. The sync worked perfectly. The files are gone.
A backup is the copy that does not take instructions from your machine. It is a point-in-time record that changes only when a new backup runs, which is exactly why it survives the events that take out everything else.
Versioning inside a sync tool is not the same thing either. It is usually time-limited, it lives in the same account that just had the problem, and recovering a large tree through it is a manual job done under pressure on the worst day of your month.
There is one specific way this bites a backup tool, and Arcamere handles it explicitly. Cloud drives keep most files as online-only placeholders: the name is on your disk, the bytes are not. A backup tool that walks your home folder naively will try to read every one of them, which quietly downloads your entire cloud drive, fills the disk and saturates the connection, all as a side effect of "back up my files".
Arcamere detects those files, skips them, and tells you exactly which ones and how much they came to, so you can decide what to make available offline and include on purpose.
Privacy
Your passphrase derives the encryption key on your machine. Chunks are encrypted before upload, and manifests, the list of what you have and where it lives, are encrypted too, so even the shape of your data is not visible in the bucket.
The salt that derives your key is stored inside the vault, not beside it on your disk. Recovering everything on a new machine needs the bucket coordinates and your passphrase, and nothing from the machine you lost.
The other side of that: if you lose your passphrase, your backup is gone. We cannot reset it. There is no recovery path, because a recovery path is a key we would be holding.
Pricing
You pay your storage provider directly.
Includes 1 TB.
Questions
Your backup becomes unreadable, permanently, including to us. That is the cost of a design where nobody but you holds a key. Store it in a password manager before you rely on the vault.
Verification recomputes the address of stored chunks and confirms they decrypt. A drill goes further: it performs an actual restore of sampled files through the same code path a real recovery uses, then compares the restored bytes against the hash recorded when the file was backed up. Verification tells you the vault is intact; a drill tells you a restore works.
That depends on the provider you choose, and you pay them directly rather than paying us a margin on it. As a reference point, Backblaze B2 publishes $6.95 per terabyte per month with downloads free up to three times your average stored amount, so a 500 GB working archive is a few dollars a month. We would rather you see that number on their invoice than hide it inside ours.
The report records exactly which file failed and how: a hash mismatch, a missing chunk, or a decryption failure. The scheduled job surfaces it loudly rather than writing it to a log nobody reads, and the health verdict flips away from healthy immediately. A failed drill is not a crisis on its own; it is the earliest possible warning, arriving on a day when you still have the original files.
The operating system, applications, and transient junk: caches, build artifacts, virtual-machine and disk images. Every one of those defaults can be removed, which is a deliberate difference from Backblaze, whose default directory exclusions cannot be. It also skips online-only cloud files that hold no bytes on your disk, and tells you which ones.
Yes. Point it at any path, including a mounted network volume. Backblaze's Computer Backup does not support network drives or network-attached storage at all and directs those users to a separate storage product plus a third-party tool.
The pipeline is streaming end to end, so a single multi-gigabyte file backs up in bounded memory rather than being loaded into RAM, and deduplication means an unchanged tree costs nothing on the next run. Chunk uploads run concurrently. The design target is roughly a couple of hundred gigabytes up to a few terabytes. It has not been exercised at tens of terabytes, and we will say so until it has.
Nine read-and-restore operations against the vault on your own machine: list snapshots, read a manifest, search, restore a file, verify, drill, back up, read drill reports, read the health verdict. It is not a channel that uploads your files anywhere, and it does not hand out your passphrase.
No. Arcamere is early. It should be one of your backups, not your only one, until it has more time and more users behind it. We would rather say that than find out with you.
Encrypted on your machine. Stored where you choose. Proven every week.
That is the question Arcamere exists to answer, and the only honest way to answer it is to try a restore. Ours does it for you every week and signs the result.
See what a drill proves