diff --git a/bench-backup.md b/bench-backup.md
new file mode 100644
index 0000000..86e8dc8
--- /dev/null
+++ b/bench-backup.md
@@ -0,0 +1,10 @@
+# Bench capture backups
+
+Capture archives from the commissioning bench sync to the backup API on
+the git box (port 8022). The sync job POSTs to `/api/sync` with the
+`X-Backup-Key` header — the key itself lives in the deploy vars in
+Mike's customer-deploy repo, not here (keep it that way after the audit
+finding).
+
+Retention: 30 days on the box, then the offsite job picks it up.
+If sync starts 401ing, the key was rotated — check deploy vars first.