Restore testing for Borg Backup and borgmatic

A finished borg create means data was written — not that you can get it back. Vaultwitness regularly reads a real file back out of your Borg archives, checks the repository, and tells you in plain words what broke and how to fix it.

Download free Do it by hand first

Completely free for up to 2 servers; 3 or more need a license. 14-day trial on any number of servers — no sign-up. Works with Borg 1.2 and 1.4, next to restic in the same dashboard.

What it checks in a Borg repository

Every problem is shown as one line — what broke — and one line — what to do.

✓
Restore testReads a real file out of the newest archive with borg extract --stdout, in full. Nothing is written to disk.
✓
Repository integrityborg check on each deep check, and the full borg check --verify-data once every N checks — every byte re-read within the period you choose.
✓
Late backupsLearns each repository's rhythm and warns when an archive is overdue.
✓
Failed backup jobsFinds the cron job, systemd unit or borgmatic timer, reads its log and explains Borg's errors: lock timeouts, a wrong passphrase, a missing repository, ssh failures.
✓
Old archives never prunedNotices when no old archive was removed for weeks and points to borg prune and borg compact.
✓
Mass deletionWarns when many archives disappear at once — a wrong prune rule, or someone deleting your backups.
✓
Database dumps & must-have filesReads dumps back from the archive and flags ones that shrank; checks the paths you marked as required.
✓
Alerts & reportsEmail, Telegram or webhook. A printable report of every check for audits.

It finds your Borg repositories by itself

No config to write. The agent reads what is already on the machine.

01

Your own scripts

Cron entries and systemd services that run borg create REPO::ARCHIVE or set BORG_REPO — with BORG_PASSCOMMAND or BORG_PASSPHRASE and BORG_RSH.

02

borgmatic

Its configuration files in both layouts, with repository labels, encryption_passcommand and ssh_command. The borgmatic timer becomes the backup job it watches.

03

Or list it by hand

One engine: borg entry in the agent's config for anything it can't see. Passphrases never leave the machine.

Careful with your repositories.

The agent only reads. It lists archives without waiting for a running backup, never breaks a lock, and runs at low CPU and disk priority, one check at a time.

Everything runs on your own servers: no cloud account, no telemetry, and it works with no internet at all. The agent is open source, so you can read exactly what runs as root.

# what a restore test does, by hand
$ borg list --last 1 --short /srv/borg
host-2026-10-15T01:35:02
$ borg extract --stdout \
    /srv/borg::host-2026-10-15T01:35:02 \
    etc/hostname | cmp - /etc/hostname

Completely free for up to 2 servers.

3 or more need a license. Try it on any number of servers free for 14 days — no sign-up, no card. Proxmox, restic and Borg are included in every plan.

Download See pricing