Where are backup sets stored?

By default in your roaming profile under ArchivstDesktop. You can change the default directory in Settings or via CLI.

Can I run headless?

Yes — use the Archivst CLI to run backups and restores without the UI.

How is my data secured?

Transport is encrypted (TLS). You can enable client-side encryption at rest with your own password.