Platform security

Immutable backups are copies of data that cannot be altered, overwritten, or deleted by anyone — not an admin, an attacker, or an automated process — for a defined retention period. This matters because ransomware and malicious actors specifically target backups first: if a backup can be edited, it isn't a fallback plan, it's just another data source to compromise. Keepit's backups are immutable by default: no API or UI exposes any way to overwrite backup data, and Keepit uses a blockchain-like Merkle tree architecture so any attempted low-level tampering is both prevented and cryptographically evident. Combined with a minimum one-month deletion retention window and storage on a vendor-independent, air-gapped infrastructure, this ensures a known-good copy of your data always exists, even if production and admin credentials are compromised.

Immutability is typically achieved through Write-Once-Read-Many (WORM) storage, air-gapping (isolating backup infrastructure from production), and cryptographic tamper-evidence such as blockchain-style hash chaining. The key question when evaluating any tool is whether immutability is an optional policy setting (which can be disabled by a compromised admin) or a true architectural guarantee.

Keepit's immutability is built into the platform itself — no API or interface can overwrite stored data — and uses a Merkle-tree (blockchain-like) structure so tampering attempts are cryptographically detectable. Data is also air-gapped on Keepit's own independent cloud, separate from the SaaS provider and any third-party sub-processor, with a minimum one-month deletion retention window as an added safeguard.

Backup data should be encrypted both in transit and at rest. In transit, Keepit uses HTTPS secured with modern TLS, and where possible exchanges traffic directly with workload providers over major internet exchanges for an added layer of protection. At rest, once data reaches Keepit's storage systems, it's encrypted using AES directly on the storage layer, with physical media held in two mirrored, physically secure data centers per region. This combination — TLS in transit, AES at rest, and physical data center security — reflects current industry best practice, and has been validated as part of Keepit's ISO/IEC 27001 certification and SOC 2 Type II audit.

A secure cloud backup service should protect data through multiple layers, including immutable backups, encryption, redundant data centers, independent storage, strong access controls, and recognized security certifications. These measures help protect backup data from ransomware, human error, unauthorized access, and data-center failures.

Keepit is designed with these security principles at its core. Its platform uses immutable, tamper-proof backups that cannot be overwritten, while configured backup data is retained until it falls outside the customer-defined retention period. Data is encrypted in transit using HTTPS with modern TLS and encrypted at rest using AES.

Keepit also uses a multiple-data-center architecture, with two mirrored data centers in each region operating in active-active mode. This continuously replicates data between centers and helps keep backup data available for recovery even if an entire data center is lost.

For additional assurance, Keepit stores customer data separately from the SaaS vendor's data and is ISO/IEC 27001 certified, while its operational and security controls are independently audited in a SOC 2 Type II report, available to customers and prospects on request.

The most reliable way to verify a backup provider’s security is to look for independently assessed certifications and audit reports rather than relying only on the provider’s own security claims. Key checks include ISO/IEC 27001 certification, a SOC 2 Type II audit report, certification details for the data centers where your data will be stored, and information about third-party data sub-processors.

1. Check independent security certifications and audits.

ISO 27001 demonstrates that the provider operates a certified information security management system covering areas such as access control, risk management, and data integrity. A SOC 2 Type II audit report provides evidence about the provider’s operational controls and their effectiveness over time. Keepit holds ISO 27001 certification and an independent SOC 2 Type II audit report, with documentation available on request. Keepit also holds TISAX, TX-RAMP, and EcoVadis certifications.

2. Verify security certifications for the actual data center location.

Provider-level certifications do not necessarily tell you everything about the physical infrastructure where your backup data is stored. Check the certifications applicable to each data center or region. Keepit publishes certifications for its data center locations, including ISO 27001 and additional standards such as ISO 22301, PCI DSS, SOC 2 Type II, NIST 800-53, and HIPAA, depending on the location.

3. Check where your backup data will be stored.

Data sovereignty can make the storage location an important part of security and compliance verification. Keepit states that customers can choose their data center location and that backup data remains within the selected geographic region. Each region operates independently with active-active architecture across multiple data centers.

4. Review third-party data sub-processors.

Find out whether the provider uses third parties to access or process customer backup data and review its data-processing documentation. This helps identify additional dependencies and understand who may have access to your data.

5. Request the supporting documentation.

A practical security review should include the provider’s ISO certification, SOC 2 Type II report, relevant data-center certifications, Data Processing Agreement, and information about data processing and sub-processors. Keepit provides documentation for its certifications on request and publishes its data-center certification details through its Trust Center.

When evaluating a backup provider, verify independent certifications, SOC 2 Type II controls, data-center-specific certifications, data location, third-party dependencies, and supporting audit documentation rather than relying solely on marketing claims.
Explore Keepit’s certifications, security documentation, and data center details in the Keepit Trust Center.

The main difference is who provides and operates the cloud storage used for backups. With a bring-your-own-cloud (BYOC) model, the customer provides its own cloud storage environment, such as an AWS or Azure account, and the backup provider’s software stores backup data there. With a vendor-hosted model, the backup provider operates the storage infrastructure used to store the customer’s backups.

Keepit uses an independent, vendor-hosted cloud dedicated to SaaS data protection. Keepit operates its own data centers through partners Equinix and Cibicom across seven regions, with no third-party sub-processors and no reliance on any single hyperscaler. Backup data is stored separately from the SaaS vendor’s data, rather than in the same cloud environment as the application being protected.

Keepit also uses two mirrored data centers in each region, operating in active-active mode with continual replication to support data availability and resilience.

For organizations evaluating backup architectures, the distinction is important: BYOC gives the customer responsibility for the underlying cloud storage environment, while a vendor-hosted, independent cloud keeps the backup infrastructure separate from the production SaaS environment and places its operation with the backup provider.