No wall of badges. No claims we cannot sign. Below is exactly what EverBack provides, which requirements it maps to, and what remains your job. If your auditor wants it in writing, we will put it in writing.
Files are encrypted on your machines before upload. The key is generated on your machine and never leaves it. We cannot read your data. Neither can the storage provider, or anyone who breaches either of us. In transit, everything moves over authenticated, encrypted channels.
Vault copies are written once and sealed at the storage layer. No credential on your machines can modify or delete them. This is not a setting somebody can flip. It is how the storage works.
Hourly copies for 30 days. Daily copies kept for as long as you are a customer. If a regulation, contract, or lawsuit asks how far back you can go, the answer is: to the day you installed EverBack.
We periodically restore real files and verify them. You get the result, with dates. "Restore procedures are tested regularly" becomes a checkbox you tick with proof attached instead of hope.
Your backups live in their own storage with their own credentials. One compromised machine cannot reach another machine's copies. One customer can never reach another customer's anything.
Backups are stored in an established open-source format. With your key, your data is recoverable by any competent engineer, with or without us. Auditors call this vendor exit strategy. We call it basic decency.
GDPR, Article 32: the regulation asks for "the ability to restore the availability and access to personal data in a timely manner" and for "regularly testing" those measures. That is, almost word for word, what EverBack does all day.
NIS2: in-scope organizations must handle backup management, business continuity and disaster recovery. EverBack covers the backup and recovery controls; your continuity plan is still yours to write.
Cyber insurance: insurers increasingly require offsite, immutable, tested backups before they will write or renew a policy. Ask us for a signed attestation describing your setup. Many customers find it pays for EverBack by itself.
Vendor security reviews: when your customer's security team sends the questionnaire, the backup section stops being the hard part. Send them this page, or send us the questionnaire.
Compliance belongs to your organization: your processes, your people, your full set of measures. EverBack supplies strong technical controls for the data-protection and recovery parts. Anyone who tells you their product "makes you GDPR compliant" is selling stickers.
We are a young company and we will not buy a badge before the audit behind it means something. Certification is on our roadmap. Until then: our architecture is documented on the security page, our claims are testable, and our engineers will answer your security team's questions directly. Substance first, certificates after.
GDPR gives people the right to be forgotten. Immutability means sealed copies cannot be edited. Both are true, so here is exactly how it works: erased data disappears from all new backups immediately, sealed Vault copies expire on their own within 10 to 30 nights, and on request we rewrite your long-term history to purge a specific file permanently. Most vendors hope you will not ask this question. We would rather answer it.
| Where is data stored? | US and EU datacenters. You choose during signup. |
| Encryption at rest? | Yes. Client-side, before upload. Keys never leave the customer. |
| Encryption in transit? | Yes. Authenticated, encrypted channels end to end. |
| Can the vendor access customer data? | No. Technically impossible without the customer's key. |
| Backup immutability? | Yes. Write-once Vault copies enforced at the storage layer. |
| Retention period? | Hourly, 30 days. Daily, unlimited for active customers. |
| Are restores tested? | Yes, periodically, with verifiable results. |
| Tenant isolation? | Dedicated storage and credentials per customer and per device. |
| Vendor lock-in / exit? | Open-source repository format. Restorable without the vendor. |
| Subprocessors? | EU storage infrastructure provider. Full list on request. |