Custom Backups Overview

Custom Upload is a general-purpose backup ingestion feature that lets Bunker customers securely back up cryptographic materials, secrets, or wallet backups that fall outside our existing first-party wallet provider integrations. It uses the same cryptographic and policy controls as our first-party integrations — the same security, durability, and customer control — while supporting a broader range of backup sources and workflows.

For step-by-step upload instructions, see How to Use Custom Uploads.

How It Works

Customer-Driven Encryption

  1. You enter text or attach a file within the Bunker console
  2. You select a recovery policy
  3. The Bunker console encrypts your input directly in the browser
  4. The resulting ciphertext is uploaded and managed identically to every other Bunker backup

Backup, Key Generation, and Recovery

Custom-uploaded backups are managed identically to any other Bunker backup:

  • When a custom upload is initiated, a backup encryption key (BEK) is generated inside a Nitro Enclave and split into customer, cloud, and HSM shares — each encrypted to its own domain, before the public key is ever released to the Bunker console for use as an encryption key.
  • Recovery is governed by your customer-defined, multi-party approval process. Bunker requires YubiKey signatures to attest to policy approvals or denials, and requires you to participate cryptographically by decrypting and providing your customer share as part of recovery.
  • Backup attestation, system integrity checks, and device check-ins all apply identically to custom-uploaded backups.

Use Cases

Custom Upload supports a wide range of high-value or sensitive backup scenarios, including:

  • Backup of infrastructure or application private keys
  • Disaster recovery copies of Ledger, Trezor, or other hardware wallet seed phrases
  • High-value secrets for business continuity (e.g., escrow keys, enterprise root certs)
  • Wallet backups for MetaMask or similar browser-based wallets
  • Backups for MPC wallet providers that don't yet have first-party Bunker integrations

Related Articles