Thinking out loud: At each host, backup to an encrypted local store (only you have to access the crypyto-key(s)). Then have the centralized backup service copy those encrypted stores.<p>You need more storage and it's more labor to setup, both of which could be impractical depending on the systems you manage, but the central service would have no access to anything confidential. Also, integration between the central backup and the variety of local hosts would be greatly simplified, with no file locks, database backups, consistency issues, backup window coordination, etc.<p>EDIT: Also, the granularity of available recovery points might be limited, at least from the central service. Block-level backups (and the associate recovery points), for example, could be implemented locally but might be hard to implement on the central service.