Security model

Concern	How Keeper handles it
Data at rest	Client-side age encryption of every data object, to recipients you control. The bucket and its provider never see plaintext.
Keys	The backup identity (private key) is read only by restorer Jobs. Keep an offline copy: without it nothing can be restored. A separate catalog key lets the console read inventories and masked previews but not dumps or WAL (ADR 0009).
Database access	Two least-privilege users per database: read-only for dumps, replication for the stream (Database users).
Kubernetes access	Cluster-wide read of Keeper's own resources; in target namespaces, read of keeper-* secrets only. Pods are non-root with a read-only root filesystem and no capabilities.
Console and API	Cloudflare Access JWT verification, four roles (viewer, operator, restorer, restorer-admin), optional org/project scopes, and an audit log of every write and every query. Requests are validated against the OpenAPI document.
Sandboxes	Their own namespace, a NetworkPolicy, generated credentials and a TTL. Exposed only through Cloudflare Tunnel behind Access when you turn it on.
Secrets in logs	Never logged: the logger redacts passwords, tokens, identities and authorization headers.

The full review, including open items, is in Security review.