The appliance keeps its state on one volume and its settings in one .env — back both up before every upgrade, and keep the encryption key somewhere else too.
What to back up
The appliance keeps its state on the /data volume, and its settings in the .env beside the compose file. Back up both and you have captured the whole appliance:
/data/postgres
Users, org settings, detections, validation runs, coverage — the database.
/data/secrets
Any secret the appliance generated, including the encryption key.
/data/repos
The detection-as-code Git repositories, one per workspace.
/data/sigma and the other clones
SigmaHQ, Security Content, Atomic Red Team, Azure Sentinel and Stratus Red Team. These re-sync from their public sources, so they are the part you could afford to lose.
/data/uploads
Profile avatars.
/data/logs
Durable application logs.
.env, on the host
Outside the volume. With the installer or the cloud bootstrap it holds TALON_ENCRYPTION_KEY and the database password, so a volume backup cannot be decrypted without it.
With the compose file from Install — the installer's or your own — the volume is named talon-studio_talon_data; docker volume ls shows yours.
Back up
Stop the appliance first, so the database files are consistent, then archive the volume:
terminal
docker compose down
docker run --rm \
-v talon-studio_talon_data:/data:ro \
-v "$PWD/backups:/backup" \
busybox tar czf /backup/talon-data.tgz -C /data .
docker compose up -d
A disk or volume snapshot taken while the container runs is not a consistent copy of the database. If your platform snapshots disks, take this archive as well.
Restore
terminal
docker compose down -v
docker volume create talon-studio_talon_data
docker run --rm \
-v talon-studio_talon_data:/data \
-v "$PWD/backups:/backup" \
busybox sh -c "tar xzf /backup/talon-data.tgz -C /data"
The container comes up with the same database, repos and history, and the entrypoint resets ownership on the volume as it starts. Restore with the image version the backup was taken with, or a newer one: migrations only run forward, so an image older than the backup meets a schema it does not know. For per-service status, GET /api/health?detailed=1 (signed in, or with the TALON_METRICS_TOKEN bearer) should report the database connected, pySigma connected and Git storage writable.
The encryption key
A volume snapshot alone is not a complete backup
A generated TALON_ENCRYPTION_KEY lives on the volume, in /data/secrets/encryption_key, so the backup and the key that decrypts it sit together — keep a copy of the key somewhere else too. If the key is set in the environment instead — the installer writes it to .env, and the cloud bootstrap to /opt/talon-studio/.env — it is not on /data at all, and a restored volume without it cannot decrypt stored SIEM tokens, AI keys, Git tokens or cloud credentials.
Rotating the key
Stored secrets are AES-256-GCM ciphertext. New writes always use TALON_ENCRYPTION_KEY; old ones still decrypt with any key listed in TALON_ENCRYPTION_KEY_PREVIOUS.
1
Back up the volume and record the current key — a generated one is in /data/secrets/encryption_key.
2
Generate a new one: openssl rand -hex 32.
3
Set it as TALON_ENCRYPTION_KEY, and the old one as TALON_ENCRYPTION_KEY_PREVIOUS. A key set in the environment takes precedence over the generated file.
4
Recreate the container and check that the SIEM, AI, Git and integration settings still load.
5
Re-save the stored credentials from the UI. There is no bulk re-encryption: each one moves to the new key when it is saved again. That includes your Talon key — paste it again on the License page, or the instance opens on the key screen once the old encryption key is removed.
6
Remove the old key from TALON_ENCRYPTION_KEY_PREVIOUS only once every credential has been re-saved and a restore test passes.
Never rotate at the same time as restoring an older backup unless that backup's key is in TALON_ENCRYPTION_KEY_PREVIOUS.
Schedule
Back up daily, keep at least 14 days, and keep a monthly archive for longer rollback windows.
Back up before every upgrade, so you can roll back cleanly if one doesn't go to plan.
Test a restore into a separate host or Compose project before you rely on the backups.