Backup and restore
Back up 3AM's data volume, and restore it on the same server or a new one.
Everything 3AM keeps is in one volume: 3am-data on a server, or the data-threeam-0 volume on Kubernetes. It holds
the audit log, incidents, connections, settings, secrets, people and the admin token. Back it up and you've backed up
3AM.
On a server, also keep ~/.3am/: the installer's settings and copies of your key files.
Backups contain secrets
The volume holds the credentials 3AM uses for your tools. Store backups the way you store passwords.
Back up
podman stop 3am-core
podman volume export 3am-data -o 3am-data-$(date +%F).tar
podman start 3am-coreStopping 3AM for the copy keeps it consistent. It picks up where it left off.
Restore
./install.sh --uninstall # skip this on a fresh server
podman volume rm 3am-data
podman volume create 3am-data
podman volume import 3am-data 3am-data-2026-10-04.tar
./install.sh --yesThen check that the audit log came back intact:
podman exec 3am-core /opt/3am/3am-core ledger-verify /var/lib/3am/ledgerCommon questions
The licence is tied to the server it was issued for. Install a licence for the new server's fingerprint: ask us to re-issue it, or on Enterprise and Strategic, add the new install yourself (Installs). Everything else carries over.
Restored on the same server, it carries on syncing. Rebuilt on a new one, it's a new member: remove the old one on the Keychain's home and add the new site (Keychain).
Daily is plenty for most teams. The audit log is the part auditors care about, so keep backups as long as your retention policy says.