Abstract: Techniques for securely migrating servers from customer networks into service provider systems are described. A backup proxy can be deployed in a customer's network and associated with one or more servers in the customer's network and with a server migration service of a service provider system. A customer can identify a server in the customer's network to migrate and the server migration service coordinates the migration with the backup proxy. The backup proxy can be instructed to obtain replication data for the server, obtain an encryption key associated with the customer from a key management service (KMS), encrypt the replication data, and upload the encrypted replication data to the service provider system. The service provider system can obtain the same encryption key used to encrypt the replication data from the KMS and decrypt the uploaded encrypted replication data to generate migrated server resources at the service provider system.