Import your existing Postgres database.
See how it works.Database-per-tenant fleets on Hetzner metal. Per-tenant point-in-time recovery, flat pricing, and nothing that leaves the EU.
A cell is one Postgres instance on Hetzner metal, holding many tenant databases. You create tenants; Baseway places them, watches them, and tells you the truth about what it sees.
One instance, many tenant databases, one namespace per organisation. Adding a tenant is a row, not a migration.
We store what you asked for and what the agent last saw. Degraded is never written down — it is the disagreement between the two.
Every multi-step operation checkpoints, compensates, and is safe to run twice. Agents replay commands; nothing double-provisions.
Continuous archiving with a stanza per cluster, and a repository we check is healthy before anything is touched.
We restore the instance to a scratch location at your target time, extract the single database, and reload it. You get one tenant back.
The procedure was run by hand against production first and written down as it actually ran. The automation is held to that document.
Every cluster gets a verified-TLS endpoint. Pick the tenant with the database name.
psql "postgresql://app:$PGPASSWORD@wispy-meadow-4f2ab91c.fsn1.baseway.tech\
/tenant_8412?sslmode=verify-full&sslrootcert=system"
psql (17.11)
SSL connection (protocol: TLSv1.3, cipher: TLS_AES_256_GCM_SHA384)
tenant_8412=> select count(*) from invoices;
count
-------
4128
(1 row)Measure the source, size the cluster from that measurement, create the cell, create the database, start the copy, watch it, finalise.
The copy runs as a Kubernetes Job in your own namespace, so an agent restart or a host reboot does not lose it.
pg_dump into pg_restore. Writes that reach the source after the import starts are not copied, and the dashboard tells you that.
A pooler sidecar beside every instance, so connection slots stay yours to spend on tenants instead of on overhead.
Data servers long-poll the control plane over HTTPS with per-server bearer tokens. Nothing ever opens a connection inward.
Endpoints are prefix.region.baseway.tech on 5432, verify-full, routed by SNI to the cell that holds the database.
The two stages the restore actually runs in. pgBackRest restores instances; you get back a database.
pgbackrest --stanza=$CLUSTER_ID info
pgbackrest --stanza=$CLUSTER_ID \
--type=time \
--target="2026-08-23 14:32:00+02" \
--target-action=promote \
--pg1-path=/scratch/restore \
restore
# The live cell is untouched. The scratch copy is the
# whole instance, rewound to the target time.A stale number presented as current is the same failure as an invented one. Every measurement shows its age rather than implying freshness.
Sampled from the cell itself and timestamped, degrading to how long ago it was seen when sampling stops.
Every state change is recorded against the organisation, the actor, and the command that caused it.
Where the system cannot prove a count, the dashboard says so instead of showing a confident zero.
Never show the customer a number the system cannot prove. A stale number presented as current is the same failure as an invented one.
Every claim below was observed against a running system and written down with its evidence. Where something is unverified, our docs say so.
Spin up a cluster on Hetzner, import an existing database from a connection string, and restore any tenant to any second.
Create a cluster