Backup verification as a service
Your backups are untested until something restores them.
Dokaz restores your Postgres backups in an isolated, single-use sandbox on a schedule, proves the data really came back, measures how long recovery took, and signs the result — so a broken backup shows up in a report, not an outage.
Daily drills on every paid tier · Cancel anytime · Postgres supported today · Connect S3, R2 or B2 with a read-only key, or push from your backup job
production-primary
Daily drill · pg_dump -Fc · 4.2 GB
Restore time
2m 14s
Rows verified
4.2M
Assertions
6 / 6
Evidence
Signed
Built for the restore-test evidence requests in
How it works
A drill, start to finish
Connect your backups
Give Dokaz a read-only key to the bucket your backup job already writes to — AWS S3, Cloudflare R2, Backblaze B2 or MinIO — and choose one file or the newest backup under a prefix. Or have the backup job push each dump to Dokaz with one curl command or the API. Dokaz never connects to your production database.
Dokaz restores it in a sandbox
On your schedule Dokaz restores the backup in an isolated, single-use sandbox machine that receives a short-lived link to that one file — never your credentials — runs your data assertions (row counts, required tables, no-null checks, SQL checks), measures RTO and RPO, then destroys the sandbox.
Collect signed evidence
Every drill, passed or failed, produces an Ed25519-signed PDF naming the backup, its SHA-256 and the measured RTO / RPO. Anyone can verify it offline with the open-source dokaz-verify tool.
Auditor-grade evidence
Proof, not a green checkmark
A backup job that "succeeded" only tells you a file was written. Dokaz proves the file restores — and hands you a cryptographically signed report, kept for a seven-year retention window, with a live tamper-check.
- An Ed25519-signed PDF for every drill, passed or failed
- Measured RTO and RPO, covered by the signature
- Verifiable offline with the open-source dokaz-verify tool
- An append-only audit log of drills and downloads
- Seven-year retention window, encrypted at rest
Backup Verification Report
- database
- production-primary
- drill completed
- 2026-05-22 04:11 UTC
- result
- all 6 assertions passed
- retain until
- 2033-05-22
Signature
ed25519:9f2c4b…a17b · valid
Capabilities
Built for teams that get audited
Scheduled drills
Verification runs on a cadence you set (daily on every paid tier), so a broken backup is caught in days — not during a recovery.
Isolated restore sandbox
Each drill restores in its own single-use machine on a private network, separate from Dokaz's app and database. It gets a 15-minute link to one backup file, never your credentials, and is destroyed afterwards.
Measured RTO and RPO
Every drill records how long the restore took and how old the backup was. Set targets and a drill that misses them fails.
A real assertion suite
Go past "it restored": assert row counts, table and column existence, non-null constraints, data freshness and read-only SQL checks on the restored data. Dokaz proposes checks from your restored schema; you choose which to keep.
Signed PDF evidence
Every drill's report is Ed25519-signed, kept for a seven-year retention window, and verifiable offline with the open-source dokaz-verify tool.
Append-only audit log
Drills, downloads, and account changes are recorded — the trail SOC 2 and ISO 27001 reviewers ask to see.
API and webhooks
A versioned JSON API and signed webhooks push drill results straight into your own tooling and alerts.
No production access
Dokaz verifies the backups you already have. It never needs a connection to your live database.
FAQ
Questions, answered
Does Dokaz need access to my production database? +
No. Dokaz only reads the backups you give it. It never connects to your live database.
How do I connect my own backups? +
Give Dokaz a read-only key to the bucket your backup job already writes to — AWS S3, Cloudflare R2, Backblaze B2 or MinIO — and choose one file or the newest backup under a prefix. Or have the backup job push each dump to Dokaz with one curl command or the API. Click Test connection to see the exact backup a drill would use, add assertions, and set a schedule.
Which databases are supported? +
PostgreSQL today — pg_dump custom, tar and plain-SQL archives, optionally gzip- or zstd-compressed.
Where do drills run? +
Each drill of your backup runs in an isolated, single-use sandbox machine on its own private network, separate from Dokaz's app and database. The sandbox receives a 15-minute link to that one backup file — never your credentials — restores it into a private Postgres server, runs your assertions, and is destroyed when the drill finishes.
What do I actually get? +
For every drill, passed or failed, a signed PDF naming the backup restored, its SHA-256, each assertion's result and the measured RTO / RPO, plus an audit-log entry — kept for a seven-year retention window and verifiable offline with the open-source dokaz-verify tool.
What does it cost? +
Three self-serve tiers — Starter $100/mo, Growth $300/mo, Grounded $600/mo — all with daily drills, unlimited team seats, signed PDF evidence, and a 7-year evidence retention window. Tiers differ by database count, drills-per-day throughput, and where you sit in the drill queue. Cancel any time from Account → Billing. See the pricing page for the full breakdown.
Can I get drill results in my own tools? +
Yes. A versioned JSON API and signed webhooks push results straight into your alerting and dashboards.
Stop guessing about your backups
Run the sample drill in minutes and see a signed report. Free to start, no card required.