Self-hosted ERPNext gives you a bench backup command and a basic scheduled backup that drops .sql.gz and files tarballs into sites/<site>/private/backups/ — on the same server that holds your production data. If that disk fails, the instance is compromised, or someone fat-fingers a bench drop-site, your "backups" die with the box. ERPNext core has no built-in off-site push, no client-side encryption, no per-destination retention, and crucially no way to prove a backup can actually be restored. For any business running ERPNext in production, that is the gap between "we take backups" and "we have disaster recovery."

Cloud Backup Manager is a proper Frappe app (its own module, hooks.py, DocTypes and scheduler events) that we build for your bench to close that gap. A Backup Destination DocType stores each target (S3, Google Drive, Dropbox, Backblaze B2, or any rclone remote), with credentials encrypted at rest using Frappe's Password fieldtype. A Backup Policy DocType defines what to back up (database, public files, private files, or all), the schedule, the retention/rotation rules (e.g. keep 7 daily, 4 weekly, 12 monthly), and which destinations to fan out to. Jobs run on Frappe scheduler_events (hourly/daily/cron) and execute inside background workers via frappe.enqueue, so long uploads never block the web workers. Every run writes a Backup Run log DocType — start/end, byte size, checksum, destination status and errors — giving you an auditable history right inside ERPNext.

Backups are encrypted client-side before they leave your server. The app streams the bench backup artifacts through age/GPG-style symmetric encryption (or SSE-KMS where you prefer server-side), so what lands in S3 or Dropbox is ciphertext you hold the key to — not a plaintext dump sitting in someone else's cloud. Uploads use boto3 for S3-compatible targets and rclone for the rest, with multipart/resumable transfer and integrity checksums verified after upload. Retention enforcement prunes old objects per policy on each destination independently, so a cheap Dropbox tier and a compliance-grade S3 bucket can hold different windows.

The part most tools skip is restore confidence. Cloud Backup Manager includes one-click restore (pull a chosen Backup Run from any destination, decrypt, and restore into a target site) plus scheduled restore drills: on a cadence you set, the app restores the latest backup into a throwaway staging site, runs a health check, and records a pass/fail on the Backup Run — so you find out your backups are broken during a drill, not during an outage. Role-based permissions (a dedicated Backup Manager role profile) keep destinations and restore actions out of ordinary users' hands, and whitelisted REST methods let your monitoring stack query backup status and trigger runs. Everything supports Frappe/ERPNext v15 and v16.

Because this is build-to-order, nothing is a shrink-wrapped download. After a short scoping call we confirm your destinations, encryption approach, retention windows and restore-drill cadence, then build the app to that spec, test it on a staging bench with a real restore, and hand over the git repository. Typical delivery is 2–4 weeks from confirmed scope depending on how many destinations and compliance requirements are in play. You get the source, install and configuration on your bench, documentation, a training session, and a post-go-live support window.