Offsite backups require SFTP. Data is encrypted and authenticated on the client unless explicitly disabled. Prefer encryption modes that use BLAKE2 for authentication, such as repokey-blake2.