Source & Backup Philosophy
A Backup, Not a Hostage.
SBG uses secure source custody and release evidence when a project requires it, but the goal is not to make you dependent on us forever. After applicable payment and handoff, client-owned custom deliverables are handled according to the governing agreement, and we want you to have an independent recovery path you control.
A backup you have never tested is just a file you are emotionally attached to.
Current SBG Practice
What Source Custody Actually Means Here
Source handling exists to protect delivery and give the client a clean recovery path. It is part of responsible project handoff, not a separate storage subscription.
- Verified source release identity and version provenance
- Authenticated source transfer where SBG is holding or delivering source
- Integrity metadata such as SHA-256 where available
- Final handoff/release evidence preserved with the project record
- Client-controlled repository or independent source archive encouraged
An SBG-recorded handoff proves SBG recorded the handoff action and associated evidence. It does not by itself prove that a client completed a download, retained every byte, opened the archive, or independently confirmed receipt.
Secure Inbound Source
Only When Requested. Only Through the Project Portal.
New Build and Atelier customers are not asked to upload an existing source ZIP as part of ordinary delivery. For an authorized Audit or Rescue, SBG first decides whether the work actually needs a source archive, repository/platform access, test or staging access, other least-privilege access, or no additional client material. Maintenance uses its own project-specific baseline workflow.
An intake, account, proposal, or preliminary conversation is not permission to send source. If SBG genuinely needs a client source ZIP, the authenticated Client Portal opens the exact Secure Source Upload only after the applicable agreement, supplemental-data, and payment gates are cleared. No open portal request means there is nothing to upload.
The authorized transfer uses private object storage and short-lived permissions scoped to the specific upload or download. Clients are not given permanent storage credentials or unrestricted bucket access.
Technical Source-Transfer Details
Designated source archives are stored in private Cloudflare R2 object storage. Cloudflare documents AES-256 encryption at rest for R2 object data/metadata and TLS protection in transit.
The custody record preserves project/account linkage, server timestamps, byte-size checks, SHA-256 fingerprint evidence, access/custody events, and retention/deletion state. The SHA-256 recorded for browser-to-R2 uploads is browser-computed while SBG independently verifies stored-object byte length and fingerprint format; the backend does not currently recompute that hash over the stored R2 object. That evidence boundary is documented rather than oversold.
Do not email source ZIPs or send Google Drive, Dropbox, WeTransfer, or unrelated file-sharing links. If a ZIP is required, use only the SBG-authorized project-specific Secure Source Upload.
Different Things
Source Backup ≠ Database Backup ≠ Secrets Backup
One ZIP cannot magically preserve every system your application depends on. Recovery planning has several separate layers.
Source material may include
- · Application source
- · Dependency lock files
- · Schema / migration files where applicable
- · Release/version references
- · Relevant project documentation
Usually Separate Recovery Concerns
- · Production database contents
- · User-uploaded files
- · Secrets / API credentials
- · MFA credentials
- · Third-party account ownership
- · Provider-specific configuration
Your Side of the Equation
Independent Backup Checklist
Whether SBG is actively working on your project or not, these are the boring things that make a future recovery much less exciting.
- You control or can access the primary source repository
- You have downloaded an independent source archive
- You know where that archive is stored
- Critical production data has its own backup strategy
- You understand source backup is not database backup
- Credentials and secrets are preserved through an appropriate secret-management process
- Deployment configuration and important third-party settings are documented where practical
- You have actually tested that your recovery material can be used
Source Storage Is Not a Separate Subscription.
Secure source transfer, release records, and backup guidance are part of responsible SBG delivery where applicable. SBG does not sell a separate ongoing source-storage subscription.