Configuration backup, restore rehearsal and evidence for a bank's firewall estate. One Rust binary on hardware you own. No cloud, no telemetry, no licence call-home.
On 15 of the 19 platforms, a capture that does not reach its documented end-of-output marker is refused and nothing is stored. Four emit no marker at all; their captures are stored flagged instead. A truncated backup you trust is worse than none.
Pre-shared keys, community strings and password hashes are replaced in terminal output, diffs and evidence packs. 170 cases gate the build.
Every version is hash-chained, and the evidence pack is signed so it verifies without the vault. Edit one number and it stops verifying.
Status, errors and diagnostics are localised into English, Hausa, Yorùbá, Igbo and Nigerian Pidgin. About half the longer CLI prose, and the whole reporting portal, are still English. Four of the five are machine-drafted with no native review yet.
| Capability | Status | What that means |
|---|---|---|
| Backup and versioning | Yes | Encrypted, deduplicated, hash-chained, on hardware you own. |
| Secret redaction | Yes | Every boundary, 27 generic patterns plus per-driver patterns. |
| Runs air-gapped | Yes | No update channel, no telemetry, no licence server, no call-home. |
| Packaged installer | No | You copy a static binary by hand. No .deb, .rpm, MSI or OVA, no signed release artefact yet, and the sample systemd unit's path is wrong. The only prebuilt Linux binary is aarch64. |
| Restore to a device | By design | Rehearsed against the stored artefact and printed as a procedure. Nothing is pushed to hardware. This costs us a row in any bake-off. |
| Lab-verified drivers | No | 15 of the 19 were transcribed from vendor documentation and human-reviewed; 4 are unverified — generic_ssh, sophos_sfos, symantec_proxysg, tufin_securetrack. None has been run against hardware. There is no device lab. |
| Windows | Partial | Cross-compiles and imports no runtime DLL. Never executed, here or anywhere. |
| High availability | No | Single node. Recovery is a person following a runbook. |
A generated, self-contained page: eleven views, most of them available as a table, a treemap or a reachability map. It loads nothing from anywhere and prints to A4.
Open the demonstration Access code required · synthetic estate, no real bank
The datasheet covers deployment, device coverage, security, evidence and an explicit list of what the product does not do yet. The brief sets BackZone against BackBox, SolarWinds NCM, ManageEngine, Oxidized/RANCID, Unimus and the vendor-native archives, and names where we lose.
Both are sent by email rather than published, because we would rather know who is reading a document that says this much about its own gaps.
One address, stored to decide who to follow up with. Not sold, not shared, no tracking pixel, no newsletter.