SECURITY & ENCRYPTION

Zero-knowledge security, from the client to the vault.

Encryption is mandatory, not optional: every byte is compressed and encrypted with AES-256 on the device before upload, keys belong only to the customer, and post-quantum TLS protects data in transit.

Request more Info

AES-256

Authenticated encryption

0-K

Zero-knowledge keys

PQC

ML-KEM in TLS

WORM

Object Lock immutability

DATA PROTECTION

Military-grade encryption, from client to storage

Data becomes ciphertext before it leaves the device and stays that way in transit and at rest: even a fully compromised storage location yields nothing readable.

AES

AES-256 encryption

All data is encrypted with AES-256 and authenticated in AEAD mode, using high-entropy random keys and hardware acceleration for minimal CPU overhead.

0-K

Zero-knowledge keys

Encryption keys are generated and managed on the client, protected by the customer's password: the platform stores only a hash and can never read your data.

ISO

Per-user isolation

Each storage vault has its own keys and access credentials: no user can ever read or decrypt another user's data.

PQ

Post-quantum transport

ML-KEM support in TLS protects data in transit against harvest-now, decrypt-later attacks from future quantum computers.

WM

Immutable storage (WORM)

Object Lock makes backups immutable: once written, they cannot be modified or deleted, even by an attacker holding valid credentials.

2FA

2FA, WebAuthn and SSO

TOTP two-factor for every account, FIDO2 WebAuthn hardware keys for administrators, and OIDC Single Sign-On with group enforcement.

ACCESS CONTROL

Hardened administration by default

Console access is protected by layered, independent controls, so backup data stays safe even if a password leaks.

  • Two-factor authentication with TOTP or hardware security keys
  • OIDC Single Sign-On with identity-provider group enforcement
  • Granular roles and permissions per operator and tenant
  • IP whitelisting and rate limiting on the admin console
  • Complete audit trail of administrative actions and jobs

HA

Active-active replicated console

WORM

Anti-ransomware immutable storage

O

Hardware required on client side

Continuity of the backup-restore cycle

DEFENSE IN DEPTH

Security controls at every layer

From key derivation to transport to storage: independent controls that reinforce each other instead of relying on a single barrier.

  • Z
    Mandatory AES-256
  • Z
    AEAD authentication
  • Z
    Zero-knowledge keys
  • Z
    Post-quantum TLS
  • Z
    Object Lock (WORM)
  • Z
    2FA & WebAuthn
  • Z
    OIDC Single Sign-On
  • Z
    Audit logging