Technical Specifications How CloudChute secures and stores backups on macOS
CloudChute is a native macOS backup app that stores your backups in your own Google Drive, Dropbox, Box, Amazon S3 or S3-compatible storage. It keeps backup copies separate from file synchronisation, with optional AES-256 encryption performed on your Mac before upload.
The technical details below explain CloudChute's system requirements, storage and security model, backup logic, encryption, and upload controls, including how these vary by storage provider.
System Compatibility
CloudChute runs on macOS Sonoma 14.4 and later.
| Feature | Specification |
|---|---|
| Operating System | macOS Sonoma (14.4) and later CloudChute requires macOS Sonoma 14.4 or later for full compatibility with the current app experience. |
| Storage Providers | Google Drive, Dropbox, Box, Amazon S3, and S3-compatible object storage via a custom endpoint |
| Processor | Apple Silicon (M-Series) & Intel |
| Architecture | Native Swift / SwiftUI Universal Binary |
| UI Theme Support | Automatic Light & Dark Mode, with the option to lock the app to Light or Dark independently of your macOS system appearance |
| Dependencies | None (No Java, No Electron) |
Security Model
CloudChute offers optional local AES-256 encryption, secure key management, independent decryption options, and provider-specific authentication and storage controls.
| Security Layer | Protocol |
|---|---|
| Encryption Standard | Optional AES-256, off until you turn it on. Performed locally on your Mac. |
| Key Management | Encryption is optional and stays off until you turn it on. When enabled, files are encrypted on your Mac before upload, so your storage providers receive encrypted data. The master encryption key, not the Master Password, is stored in the macOS Keychain. Wrapped copies of the key are held in encryption_config.json. These copies are protected so they can be unlocked using the Master Password (set when enabling encryption) or the 24-word Recovery Phrase if the macOS Keychain copy is no longer available.CloudChute's own service does not keep a copy of your master encryption key. On Dropbox, the file is stored at /Apps/CloudChute/.cloudchute/encryption_config.json.On Box, Amazon S3 and S3-compatible storage, it is stored at .cloudchute/encryption_config.json.On Google Drive, it is stored in appDataFolder, so it is not available as a normal download from the Drive website. |
| Manual decrypt | Dropbox, Box, Amazon S3, and S3-compatible storage keep encryption_config.json as a normal file next to the backup. With that file and the Master Password or the 24-word recovery phrase, you can decrypt a downloaded copy on a computer that does not have CloudChute. Google Drive stores the same file in appDataFolder. See the FAQ. |
| Provider authentication | CloudChute uses official OAuth-based authentication flows for Google Drive, Dropbox, and Box. Amazon S3 and S3-compatible storage are limited to the bucket you configure. CloudChute always stores backups under the .cloudchute/ prefix in that bucket. You do not choose the prefix. S3-compatible storage also requires its endpoint. If a bucket uses SSE-KMS, the IAM identity also needs permission to use the relevant KMS key. |
Isolation & Scoping
Access depends on the provider. Google Drive, Dropbox, Box, Amazon S3 and S3-compatible storage are described below.
| Provider | Security Impact |
|---|---|
| Google Drive | Google Drive backups are stored in appDataFolder, so the vault is hidden from the normal Drive web interface whether or not client-side encryption is enabled. Sign-in also requests drive.file. With encryption off, you can copy those backups into the visible My Drive folder. |
| Dropbox | Dropbox backups are stored in a /Apps/CloudChute/.cloudchute folder. |
| Box | Box backups are stored in a .cloudchute folder. The app requests root_readwrite and uses a dedicated folder only when the connection supplies a downscoped folder id. Without that id, Box operations are not limited to one folder. |
| Amazon S3 | Amazon S3 is limited to the bucket you configure. CloudChute always stores backups under the .cloudchute/ prefix in that bucket. You do not choose the prefix. If a bucket uses SSE-KMS, the IAM identity also needs permission to use the relevant KMS key. |
| S3-compatible | Same connection as Amazon S3, plus a custom endpoint (for example Wasabi, Backblaze B2 S3 API, Cloudflare R2, or MinIO). A service that provides an access key, secret, region, bucket name, and endpoint should work. See S3-compatible storage. |
Backup Logic
CloudChute is a one-way backup engine, not a sync client. Deleting or changing a file on your Mac does not remove earlier protected copies from your vault, which is why CloudChute is designed for recovery rather than collaboration.
| Logic Type | CloudChute Performance |
|---|---|
| Data Location and Visibility | Backups are stored in your own connected provider account. The exact visibility depends on the provider and whether encryption is enabled; with encryption enabled, files are stored as unreadable encrypted data and are restored through CloudChute. |
| Data Retention | Non-destructive (Deletions on Mac do not affect the vault) |
| Data Sovereignty | Your backups remain in your own storage account. After cancellation, existing backups can still be restored, including from the Mac App Store version. New backups require an active subscription. |
| Environment Scope | Monthly, annual and two-year subscriptions cover up to four backup locations. Each Google Drive, Dropbox or Box account counts as one location. Each Amazon S3 bucket counts as one location. For S3-compatible storage, each combination of server address and bucket counts as a separate location. Each location has one recorded Mac at a time. Another Mac can take over the slot by signing in to that location, and the previous Mac can reclaim it by signing in again. Enterprise subscriptions allow one recorded Mac per storage provider. |
| File Integrity | Google keeps the revisions created by each update. On Dropbox and Box, version history follows the provider account. On Amazon S3 and S3-compatible storage, older copies are available in Restore only when bucket versioning is already enabled. CloudChute does not turn versioning on. Restore can still return a whole folder or a specific file version when that provider has one to return. |
| System Impact | During a backup, CloudChute checks file size and modification time to decide what to upload. It does not run a continuous background scan. When a manual or scheduled backup runs, CloudChute prevents the Mac from going to idle sleep. |
| Connectivity | Per-provider upload engines with user-configurable concurrency, large-file handling, and retries. See Upload performance. |
| Menu bar | Shown by default; hide the icon in Settings. The menu shows whether automatic backup is on, the schedule (hourly, daily, weekly, or custom), when the last backup finished, and when the next one is due. While CloudChute is open it also lists recent activity — files uploaded, left unchanged, or failed — and can open Reports or bring the CloudChute window forward. With a schedule turned on, the icon stays after you quit, so those times remain visible and the app can be opened again from the menu. See the FAQ. |
| Finder | Folders can be added from Finder with Send to CloudChute in the right-click menu (Mac App Store: Send to CloudChute MAS). That adds the folder only. It does not start a backup. Start one with Backup All, or wait for the scheduled backup. Enable the extension in System Settings → General → Login Items & Extensions → Finder Extensions. It stays enabled after app updates. See the FAQ. |
A Different Approach to Encrypted Backups
CloudChute uses file-level change detection to keep your backups straightforward and efficient to manage. Optional AES-256 encryption is off until you turn it on.
Rather than tracking changes within individual file blocks, CloudChute identifies changed files using filesystem metadata, including modification dates and file sizes. Changed files are uploaded as a whole. When encryption is on, they are encrypted locally first.
This approach avoids the need for a separate local block-tracking database. It also means that when a file changes, CloudChute backs up the file as a whole rather than uploading only the modified portions.
Upload Performance
After storage is connected, Settings exposes Upload Strategy and Concurrency & Retries. Each provider uses an upload model matched to its API; preferences are stored separately per provider so switching destinations does not mix tuning.
| Provider | Upload strategy | Concurrency & retries |
|---|---|---|
| Google Drive | Large-file threshold for resumable chunked uploads; configurable chunk size for memory vs. throughput. | Parallel files and folder trees, max network connections, retry attempts, and base delay between retries after connection failures. |
| Dropbox | Immediate vs. batch upload commitment; optional deep integrity pre-check (off, weekly, or monthly) when encryption is disabled. | Parallel transfer limit; small-file high-efficiency mode for large numbers of small files. |
| Box | Large-file threshold for chunked upload; memory buffer size for chunk preparation (lower values reduce RAM on older Macs). | Max concurrent uploads; error recovery presets (conservative, standard, or aggressive retries for transient and locked-file errors). |
| Amazon S3 / S3 API | Upload Strategy panel is not shown for S3. Files stream from disk; multipart upload applies when size meets the configured threshold. S3-compatible hosts use the same engine via a custom endpoint. | Max concurrent uploads; multipart threshold and part size; SDK retry aggression presets matching Box. |
All providers using the shared backup walk: ignored path names in Storage settings skip matching folders and files during traversal (for example node_modules or .git). Exact defaults and ranges are configured in the app and may change between releases.
S3-Compatible Storage
CloudChute backs up to Amazon S3 and to other object stores that speak the S3 API. Amazon S3 needs an access key, secret, region, and bucket name. Leave the endpoint empty. An S3-compatible service uses those same fields plus its endpoint, and it should work when it provides them. Examples include Wasabi, Backblaze B2 (S3 API), Cloudflare R2, and MinIO.
| Topic | Detail |
|---|---|
| Connection | Amazon S3: access key, secret, region, and bucket name. Leave the endpoint empty. S3-compatible storage: those same fields, plus the endpoint. See Amazon S3 and S3-compatible storage. |
| Multi-Mac plans | Amazon S3 counts a bucket. S3-compatible storage counts an endpoint and bucket together, so the same endpoint can be used with a different bucket. A standard subscription covers up to four storage destinations. If another Mac signs in to a destination already in use, it becomes the recorded Mac for that destination. The first Mac can sign in again to take over that destination. Enterprise subscriptions record one Mac per storage provider. See the FAQ. |
The "Silent" Design
As musicians and engineers, we designed CloudChute to be silent. It is engineered to run in the background without causing audio dropouts or system lag during high-intensity tasks like mixing, mastering, or rendering.