The problem with hosted connectors
Most backup and monitoring services ask you to open a firewall rule and hand over a privileged user. That turns their breach into your breach, and it puts your database on the public internet for the convenience of a vendor.
How an outbound agent changes the model
A lightweight agent running next to the database opens a single outbound TLS 1.3 connection. No inbound ports, no firewall exceptions, and credentials that never leave the host they were issued on.
Discovery runs against read-only catalogue tables, so the agent can enumerate instances, versions and sizes without ever holding write permissions on production data.
Zero knowledge in practice
Encryption happens before anything is transmitted, with a key you control. The cloud side stores ciphertext and metadata; it has no ability to decrypt a backup even under subpoena.
