LeoCore Backup · Verified database backup
Database backup that proves it worked.
Scheduled, encrypted backups for SQL Server, MySQL, MariaDB, PostgreSQL and Firebird — and for the files and folders around them — running as a Windows service on your own hardware. Every archive is re-read, checksummed and test-restored — so the first time you find out a backup is good is not the day you need it.
5 database engines 13 storage destinations Perpetual licence from $89 No telemetry, no account required
The problem
A backup nobody has restored is a rumour.
Almost every backup tool tells you a job succeeded. That means the file was written. It does not mean the dump is complete, that the archive opens, that the chain is intact, or that the database comes back. Those are different claims, and only one of them matters at 3am.
How it proves it
Four layers between “job succeeded” and “you can restore”.
The archive is re-read
SHA-256 integrity check and a full re-read after writing, validating the CRC and the AES authentication tag on every entry. Included in every edition, free one as well.
The engine agrees
Engine-level verification — RESTORE VERIFYONLY on SQL Server,
pg_restore --list on PostgreSQL — plus a check of the engine’s own
trailer to confirm the dump actually finished.
It is restored, on a timetable
Automated restore drills bring the archive back into a scratch database on a schedule, run your own validation query against it, drop it and email the result. Proof of recoverability without a human remembering to check.
Every restore point is rated
Verified, proven by a drill, or suspect. Not a green tick that means the file exists — a status derived from what was actually tested.
A recovery kit
Written beside every archive: every database name and its constituent files, the restoration sequence, SHA-256 hashes, all copy locations, and the exact restore commands for that engine. It plainly states that it holds no password.
LeoCore Rescue — free
A standalone executable with no installer, no service and no .NET requirement. It reads a folder of archives that has no catalogue at all, and recovers the archive password from the machine that made the backups. Keep a copy in your storage beside the archives.
Ransomware
The backup is the target. Treat it like one.
Modern ransomware finds the backup share first and encrypts it before touching production, because that is what forces payment. Three defences, all in Datacenter.
Immutable storage
S3 Object Lock in governance or compliance mode, and Azure immutable blobs with time-based retention. An object cannot be overwritten or deleted until its retention expires — not by you, and not by anything running as you.
Append-only credentials
The backup job holds create-only permissions. Deletion happens through a separate restricted identity, so a compromised backup service account cannot erase history.
It notices mass deletion
Each backup is compared with the one before it. When a table is emptied,
dropped, or loses most of its rows, you are told. For files, it warns when most
of a set is rewritten or deleted at once, or renamed onto an extension like
.locked. Either way the copy taken beforehand is held back from
retention rather than ageing out.
What it backs up, and where to
Five engines, the files around them, thirteen destinations.
Database engines
- SQL Server 2012–2022, Express, and Azure SQL Database
- MySQL 5.7 and 8.x
- MariaDB all versions
- PostgreSQL 10–16
- Firebird 2.5–5.0
- Managed cloud — Amazon RDS, Aurora, Azure SQL
Storage destinations
- Local folder and network share
- Amazon S3 and S3-compatible — Wasabi, MinIO
- Backblaze B2, Azure Blob Storage
- Google Drive, Dropbox, OneDrive, OneDrive for Business, Box, Yandex.Disk
- FTP, FTPS and SFTP
Files and folders
- Folders, single files and network shares, with exclusions
- Open files read from a Volume Shadow Copy — Outlook and QuickBooks files are not skipped
- Full and differential, every file checked against its SHA-256
- Browse and search a backup; restore one file, a folder or everything, NTFS permissions included
- Databases still go through each engine’s own tools — a copied live database file generally will not restore
Full, differential, log
Differential and transaction-log backups on SQL Server, MySQL, PostgreSQL and MariaDB, with point-in-time recovery resolving the full → differential → log chain and validating LSN continuity before it starts.
Retention that understands chains
Keep-last-N and minimum retention age, set per job and per destination, with GFS retention in Datacenter. It never deletes a full backup that a differential or log still depends on.
More than the data
On SQL Server it scripts logins with their SIDs so users are not orphaned on restore, plus server role membership, linked servers and Agent jobs.
Runs unattended
A Windows service in every edition, free one included: signed out, across reboots, on Server Core, under a gMSA. Hourly minimum frequency with run windows, weekday and monthly rules; late slots run within 30 minutes, missed slots are skipped.
Checked in daylight
Connection, permissions and every destination are tested during the day rather than at 2am. It also finds databases nobody is protecting — while knowing that tempdb and master are not oversights.
Tells you properly
Email on failure or every run, Windows Event Log, and Slack, Teams or JSON
webhooks — one POST per run outcome. A CLI with --json and exit codes
for your own automation. On failure, the complete error, not a code.
Recovery time, measured
Not estimated. Recovery time comes from actual drills, and exposure is read from the newest archive that genuinely exists — an hourly job whose last stored copy is Tuesday reports four days, loudly.
Audit report, one button
Dated, against the controls in ISO 27001, NIS2, SOC 2, HIPAA and DORA. Nothing is asserted — every status is derived from records, and failures stay in. Datacenter.
The estate on one screen
Twelve servers, no console to install and nothing hosted. Every edition publishes its status; the Datacenter console reads them all over a plain file share you already own.
Editions
Three editions, priced by databases.
Pick the tier by how many databases you protect. Every edition encrypts, verifies and restores without limits, every edition runs unattended as a Windows service, and every edition backs up files and folders as well — the paid tiers add scale, alerts, cloud storage and compliance.
Scale
| Capability | Solo | Server | Datacenter |
|---|---|---|---|
| Databases counted across all jobs | 2 | Unlimited | Unlimited |
| Files and folders shadow copy for open files | 1 set, up to 50 GB | Unlimited | Unlimited |
| Backup jobs | 2 | Unlimited | Unlimited |
| Destinations per job | 1 | 3 | Unlimited |
Automation
| Capability | Solo | Server | Datacenter |
|---|---|---|---|
| Scheduling — hourly minimum, run windows, weekday & monthly rules | ✓ | ✓ | ✓ |
| Late slots run automatically Within 30 minutes. A slot missed because the server was off is skipped, not replayed as a backlog. | ✓ | ✓ | ✓ |
| Runs while signed out, as a Windows service Server Core, gMSA, across reboots | ✓ | ✓ | ✓ |
Database engines
| Capability | Solo | Server | Datacenter |
|---|---|---|---|
| SQL Server, MySQL / MariaDB, PostgreSQL, Firebird Firebird 2.5 to 5.0, full backups | ✓ | ✓ | ✓ |
| Azure SQL Database BACPAC export via DacFx | — | — | ✓ |
| Amazon RDS & Aurora — PostgreSQL and MySQL RDS for SQL Server is not supported: AWS blocks the native BACKUP command it needs. | — | — | ✓ |
| SSH-tunnelled connections MySQL and PostgreSQL | — | — | ✓ |
Backup & restore
| Capability | Solo | Server | Datacenter |
|---|---|---|---|
| Full backups | ✓ | ✓ | ✓ |
| Differential backups | — | ✓ | ✓ |
| Transaction-log backups | — | — | ✓ |
| Point-in-time restore with chain resolution Needs transaction-log backups, so it follows the tier that can make them. | — | — | ✓ |
| Full restore of any archive you hold Never gated. Never expires. Even after a licence lapses. | ✓ | ✓ | ✓ |
| Restore over the original, as a new database, or to a different server Not gated either — every restore option is in every edition. | ✓ | ✓ | ✓ |
Storage
| Capability | Solo | Server | Datacenter |
|---|---|---|---|
| Local folder & network share | ✓ | ✓ | ✓ |
| OneDrive & OneDrive for Business | ✓ | ✓ | ✓ |
| S3, S3-compatible, B2, Wasabi, Azure Blob | — | ✓ | ✓ |
| Google Drive, Dropbox, Box, Yandex, FTP/FTPS/SFTP | — | ✓ | ✓ |
| Bandwidth throttling | — | — | ✓ |
Protection & assurance
| Capability | Solo | Server | Datacenter |
|---|---|---|---|
| AES-256 encryption & compression profiles | ✓ | ✓ | ✓ |
| SHA-256 integrity check & archive re-read | ✓ | ✓ | ✓ |
| Engine-level verification RESTORE VERIFYONLY, pg_restore --list — on every backup, in every edition | ✓ | ✓ | ✓ |
| Scheduled restore drills with validation query | — | — | ✓ |
| Immutable storage — Object Lock, Azure immutable, append-only | — | — | ✓ |
When it goes wrong
| Capability | Solo | Server | Datacenter |
|---|---|---|---|
| Known-good restore points every point rated; verified everywhere, and proven by a drill on Datacenter | ✓ | ✓ | ✓ |
| Recovery kit written beside every archive | ✓ | ✓ | ✓ |
| LeoCore Rescue a free download for anyone, licence or not | ✓ | ✓ | ✓ |
| Measured recovery time & data at risk | ✓ | ✓ | ✓ |
| Databases nobody is protecting | ✓ | ✓ | ✓ |
| Daylight readiness check | ✓ | ✓ | ✓ |
| Fleet view across machines every edition publishes its status; Datacenter reads the estate | — | — | ✓ |
Retention & operations
| Capability | Solo | Server | Datacenter |
|---|---|---|---|
| Keep last N backups of each kind | ✓ | ✓ | ✓ |
| Minimum retention age | — | ✓ | ✓ |
| GFS retention with chain safety | — | — | ✓ |
| Email notifications | — | ✓ | ✓ |
| Windows Event Log integration | — | ✓ | ✓ |
| Slack, Teams & JSON webhooks one POST per run outcome, to your own endpoint | — | ✓ | ✓ |
| Command line run, restore, status --json, evidence — with exit codes an automation can branch on | — | ✓ | ✓ |
| Commands before and after a run stop a service, back up, start it again | — | ✓ | ✓ |
Licence & support
| Capability | Solo | Server | Datacenter |
|---|---|---|---|
| Updates | Free, always | 12 months renewable, never required | 12 months renewable, never required |
| Support | Email, best effort | Email, 2 business days | Priority, 1 business day |
| Commercial use | ✓ | ✓ | ✓ |
LeoCoreAgent service runs backups on a machine nobody is logged into — across reboots, on Server Core, under a gMSA — in Solo too, because a free backup that quietly waits for someone to sign in is not a backup. What the paid editions add is scale and being told: more databases and destinations, cloud storage, differential and log backups, and email and webhook alerts when something fails. Pricing
One payment. Per server. For ever.
Perpetual licence, lifetime updates available, 14-day money-back guarantee. Restore is never gated by a licence — in every edition, for any archive, for ever.
- 2 databases, 2 jobs
- All five engines
- Files and folders: 1 set up to 50 GB, not counted as a database
- Hourly scheduling with run windows
- Local, network share and OneDrive
- AES-256 encryption, SHA-256 and engine-level verification
- Unrestricted restore, for ever
- Runs unattended as a Windows service
- Commercial use allowed, no ads, no telemetry
- Unlimited databases and jobs
- Unlimited file sets, no size limit
- Differential backups, of databases and files
- Ransomware warning for files
- All 13 destinations, 3 per job
- Email alerts, webhooks, Event Log
- CLI with pre/post-run commands
- Email support, 2 business days
- No transaction-log backups or restore drills
- Everything in Server, plus:
- Automated restore drills, of databases and file sets
- Point-in-time restore with full chain resolution
- Immutable storage and Object Lock
- Transaction-log backups, GFS retention
- The estate view across all machines
- Azure SQL, Amazon RDS and Aurora
- SSH tunnels, bandwidth throttling, unlimited destinations
- Priority support, 1 business day
Volume licensing — Datacenter
| Servers | Total | Per server |
|---|---|---|
| 1 | $199 | $199 |
| 3 | $499 | $166 |
| 10 | $1,290 | $129 |
| Site licence, up to 25 | $2,990 | $120 |
Prices in USD. Tax follows the rules of your own country — in Bahrain it is included in the price shown. Payment taken by card or bank transfer through our Merchant of Record.
Our commitment
Your backups do not depend on us continuing to exist.
What if LeoCore disappears tomorrow?
Your archives are standard Zip64 with AES-256 — 7-Zip opens them on any machine with the password. The recovery kit beside each archive holds the exact restore commands and hashes. LeoCore Rescue is a free standalone executable that reads a folder of archives with no catalogue at all. Nothing in the restore path needs us, a server, or a licence.
Is restore ever gated by the licence?
Never, in any edition, for any archive, for ever. That includes an expired licence, a lapsed renewal and the free Solo edition. Holding a customer’s data hostage to a renewal is not a business model we are interested in.
Does it phone home?
No telemetry, no analytics, and no account required to back up. Credentials are sealed with Windows DPAPI, bound to the machine, and never leave it. Offline activation is available for air-gapped networks — copy the machine fingerprint, paste it into a form, receive a signed licence, and the application never needs the internet again.
How do updates work?
Self-installing. It fetches the installer and verifies its SHA-256 against the published release before running it, rolls back automatically on failure, and never touches jobs, schedules, credentials or history.
Find out tonight, not at 3am.
Solo is free for ever on two databases, with full encryption, verification and unrestricted restore. Point it at a real database and let it prove itself.