diff --git a/src/backups.js b/src/backups.js
index f8a41cf0e..fabcc40fe 100644
--- a/src/backups.js
+++ b/src/backups.js
@@ -11,6 +11,8 @@ exports = module.exports = {
     list,
     del,
 
+    removePrivateFields,
+
     BACKUP_IDENTIFIER_BOX: 'box',
     BACKUP_IDENTIFIER_MAIL: 'mail',
 
@@ -52,6 +54,10 @@ function postProcess(result) {
     return result;
 }
 
+function removePrivateFields(backup) {
+    return backup;
+}
+
 async function add(data) {
     assert(data && typeof data === 'object');
     assert.strictEqual(typeof data.remotePath, 'string');
diff --git a/src/routes/backups.js b/src/routes/backups.js
index 9c3d60cb3..a40911942 100644
--- a/src/routes/backups.js
+++ b/src/routes/backups.js
@@ -30,7 +30,7 @@ async function load(req, res, next) {
 async function get(req, res, next) {
     assert.strictEqual(typeof req.params.id, 'string');
 
-    next(new HttpSuccess(200,  req.resources.backup));
+    next(new HttpSuccess(200,  backups.removePrivateFields(req.resources.backup)));
 }
 
 async function list(req, res, next) {
@@ -43,7 +43,7 @@ async function list(req, res, next) {
     const [error, result] = await safe(backups.getByIdentifierAndStatePaged(backups.BACKUP_IDENTIFIER_BOX, backups.BACKUP_STATE_NORMAL, page, perPage));
     if (error) return next(BoxError.toHttpError(error));
 
-    next(new HttpSuccess(200, { backups: result }));
+    next(new HttpSuccess(200, { backups: result.map(backups.removePrivateFields) }));
 }
 
 async function update(req, res, next) {