Three moving parts. You only ever install one.
Paste a registration token into the agent once. Everything after that — schedules, retention, restores, updates — is driven from the console, and keeps running whether or not anyone is logged in.
No inbound ports are opened on your network. Commands reach the agent over an outbound, per-device stream with its own scoped credentials, and results come back over ordinary HTTPS. Nothing on the machine accepts a connection from the network, so there is no firewall hole to open and nothing for an attacker to reach from outside it. There is also no cron job to keep alive and nothing that can quietly stop firing in March.
The thing on the machine stays out of the way.
This is the agent’s own window, and it is deliberately small. It shows what is happening and lets someone start a run. It is not where backups are configured, because that would mean a person on every machine.
A Windows service and a small tray application. The service starts with the computer; the tray app only shows status and lets someone start a run by hand.
Windows servers and Windows laptops. There is no macOS or Linux agent.
The console issues a token, you paste it into the agent, and the device appears in the fleet. That is the last time anything is typed on that machine.
Everything after this — schedules, retention, restores, updates — is driven from the console.
A policy sets the frequency, the sources, the compression, the exclusions and how long restore points survive. It then applies to every device attached to it.
Change the policy and the whole group follows. No per-machine scheduled task to maintain.
The first run is the expensive one because everything is new. In the morning, open the restore point, walk it like a filesystem, and pull one file back.
That is the whole evaluation, and it takes about ten minutes of your time.
Agents update themselves, and roll back if the new one fails.
No login to forty machines to install a patch. A new build is downloaded, checked against its SHA-256 and swapped in by the agent itself — with the old binary kept and restored automatically if the new one will not start. The outcome is recorded per device.
Checked before it is trusted
The downloaded build is verified against its SHA-256 before anything is swapped. A build that does not match is not installed.
Rollback is automatic
The previous binary is kept. If the new agent fails to start, the old one comes back on its own, and the device does not stop backing up while somebody investigates.
Logs on request, not on a remote session
The console can ask a device for its recent logs. The agent zips and uploads them itself — no remote desktop, and it works while the failing job is still in progress.
The whole path, from the drive to the vault.
On the machine
- Windows service, starts with the machine
- Backs up with no user logged in
- Tray app for status and manual runs
- One-time token registration
- Self-update verified against SHA-256
- Automatic rollback to the previous binary
- No inbound ports — outbound command stream over HTTPS
Before upload
- The agent walks the source tree itself
- Shadow-copy reads for open files
- Deduplicated against that device’s own history
- Compressed, at the level the policy sets
- Encrypted with that device’s own key
- Checkpointed, so an interrupted run resumes
In the vault
- One repository per device
- One bucket per workspace
- Versioned restore points, nothing overwritten
- Retention as an age in days and a count of points
- Server-side expiry the endpoint cannot reach
- Device keys re-checked against policy hourly
In the console
- Jobs stream live from backend events
- Fleet health score over 30 days
- Failed-snapshot queue, oldest first
- Missed-backup alerts with reason codes
- Snapshot browsing before a restore
- Owner / admin / member roles and expiring invites
What a policy holds
- Frequency: hourly in a window, daily, weekly, monthly
- Sources: whole volumes or named folders
- Exclusions, layered on the built-in list
- Compression level
- Retention in days and in count
- The devices it applies to
What it is not
- Not disk imaging
- Not bare-metal recovery
- Not a macOS or Linux agent
- Not object-lock or WORM storage
- Not zero-knowledge — key management is on our side
- Not a sync folder
About the part that lives on your machines.
What exactly runs on my machines?
One Windows service and a small tray application. The service does the work and starts with the machine, so backups happen whether or not anyone is logged in. The tray app is only there to show status and let someone start a run by hand. Nothing on the machine accepts a connection from the network — the agent reaches out, so there is no inbound port to open and no firewall hole for an attacker to aim at.
Do you have a macOS or Linux agent?
Not today — the agent ships for Windows only, and we will not put a date on another platform.
Does it slow the machine down?
The first run is the expensive one, because everything is new — and it does not have to finish in one sitting. A run cut short by a dropped connection, a machine going to sleep or the agent updating itself is recorded as interrupted rather than failed, and it picks up from its last checkpoint instead of starting the upload again. After the first run the agent still walks the tree, but only new and changed content is hashed and uploaded. Schedules exist so the heavy runs land at 02:00 rather than at 14:00.
Do I have to open a port in the firewall?
No. The agent opens no inbound port. Commands reach it over an outbound, per-device stream with its own scoped credentials, and results come back over ordinary HTTPS.
How do I get the agent onto forty machines?
Install it once per machine with the registration token for that workspace. After that, updates are the agent’s own job: it downloads a new build, checks it against its SHA-256, swaps it in and rolls back automatically if the new one fails to start.
Ready to try it on one machine? Start the 14-day trial → Every device name and figure on this page is demo data.
Start with Comsky Backup.
Grow into the ecosystem.
One account opens every Comsky product — and one invoice covers them, however many you run.