I use duplicity for create, encrypt backups. To store them I use two USB SSD drives (in two separate locations); for off-site I use AWS' glacier.

The backups are scheduled with jobs in self-hosted Jenkins instances.