Primary backup is private recovery project + signed manifests (no plaintext secrets). Restore is isolated by default with MFA and two-person control for high-impact. Bunny is optional encrypted secondary only — never CDN, never primary. No raw DB download.