Every encrypted backup has a second copy of the same fact stored in exactly one place: a human head. The passphrase. The backup is tested, encrypted, replicated to two regions — and then the person who set the key resigns on a Friday, and Monday morning your entire backup estate is a pile of beautiful, unreadable bytes.
This is not a hypothetical edge case. It is the most common way a working backup program fails: not corruption, not missed jobs — a key that exists in exactly one head, and that head just went on three weeks of leave.
Escrow is a second, independent way to open the backup. Not a sticky note. An intentionally stored, findable, dated secret whose only reader is a documented emergency. If your backup encryption checklist already says "two-path key storage," escrow is the paperwork that makes the second path real instead of theoretical. And you already run escrow elsewhere: the break-glass admin account is escrow for identity, printed TOTP codes are escrow for MFA. Backup keys deserve the same treatment — deliberately stored, deliberately restricted, deliberately tested.
Three patterns actually work at small-team scale. Pattern A, the sealed offline kit: passphrase printed, in a sealed envelope, in a safe or with a trusted third party — two envelopes, two locations. Cheap, offline, impossible to phish; failure mode is that an envelope is a point-in-time copy, so every key rotation re-seals it. Pattern B, the shared vault item: a restricted entry in the password manager you already use, visible to two named people, not "admins" — whoever can see the vault item can open the backup, which is exactly why the access list is two people. Pattern C, split knowledge: two halves, escrowed separately, no single person can reconstruct it alone — the pattern auditors and cyber-insurance questionnaires love, and the one that turns your quarterly drill into a two-person rehearsal.
What does not work, in order of how often we've seen it: the key stored in the same cloud account as the backup (one stolen credential opens both), the key only in the founder's head, the key in a chat message from 2023, and the key written into the runbook itself. If the escrow location is reachable by whoever stole the first breached laptop, it is not escrow — it is storage with better branding.
The drill that makes it real takes fifteen minutes a quarter. Restore one file from the encrypted backup using only the escrowed key, without asking the key-holder — pick the person least likely to know the passphrase by heart. Log the result next to the archive, same ledger as your regular restore test. Split-knowledge teams: the two halves meet for the first time during this drill. New hires: the escrow walkthrough belongs on the same onboarding path as the break-glass walkthrough — both are "the thing you hope never to run, rehearsed until it is boring." Rotate who runs the drill each quarter; a ritual owned by one person drifts.
Offboarding has a key step, not just an account step. When the key-holder leaves: rotate the backup key first, re-encrypt or verify the archives under the new key, re-seal every envelope, then walk the leaver through deletion of any personal copies they made. Nobody resigns with the only key — that's the entire point of the card. If that's not true at your company today, the fastest fix in this article is: pick a second person, open the escrow, run the drill this week.
And the ending nobody plans for: lost key + encrypted archive = gone. Not "recoverable with effort." Brute-forcing a modern passphrase is a rounding error against eternity; the only realistic recovery is the escrowed copy. Exposed escrow is the other branch: rotate, don't argue — rotation costs hours, hope is not a control.
The full one-pager — the three escrow patterns with their honest failure modes, the escrow card template, the quarterly drill, and the key-holder offboarding sequence — is free on our ops-notes site:
Backup Key Escrow for Small Teams →
It pairs with two neighbors: the backup encryption checklist (encrypt the archive without losing the ability to read it) and the backup restore test checklist (the quarterly proof your backups work at all). If you want the fill-in-the-blank versions, the Ops Starter Kit is $14, and the free one-page First 30 Minutes incident checklist is the place to start.
Top comments (0)