The DR copy sits on a second box you rent, no backup vendor between

Now: a cron entry snapshots the container at 02:00. Snapshots are copy-on-write deltas on the server's own disk. A second step POSTs /copy to a server you rent in another facility. The copy is a full container, bootable, idle, costing nothing while it waits.

The disk under both servers is LUKS-encrypted, and the key that unlocks it is held off the machine it unlocks. A drive pulled from either rack holds ciphertext.

No backup vendor holds a copy. No bucket lists your filenames. The restore drill is starting the copy and pointing an alias at it.

Two servers, both yours, and nobody in between holds a readable copy.