Security & key custody
You hold the keys. We hold the operational burden.
Backup vendors are judged on restore day, not on backup day. This page sets out exactly what protects your data, who can read it, and — the part most vendors skip — what Proxmox Backup Server does not actually do.
About the word “immutable”
Plenty of backup marketing — including, previously, our own — describes Proxmox backups as immutable copies that cannot be altered or deleted. That is not accurate. Proxmox Backup Server has no immutability flag, no retention-lock API, and no WORM certification. An administrator, or a stolen token with prune rights, can still delete.
We would rather correct that here than have you discover it during an audit. What genuinely protects you is the combination below, and each layer is something you can verify for yourself.
What actually resists ransomware
Five real mechanisms, none of which is a checkbox in the PBS interface.
- Content-addressed chunk store — a normal backup run writes new chunks and cannot overwrite an earlier snapshot's data
- ZFS snapshots on the datastore, so filesystem-level deletion does not remove a prior snapshot
- Backup tokens issued without prune or delete rights, so a compromised PVE host cannot erase its own history
- Optional S3 Object Lock on a synced bucket, which is the only genuine WORM in the chain
- Separation of duties on who may prune, run garbage collection, or delete a namespace
Encryption and key custody
- Client-side encryption is performed by PBS on your side before chunks leave your network
- You hold the keys. Computer Port does not need and does not hold your plaintext
- Traffic is protected with TLS in transit, and the server is pinned by fingerprint
- Losing your key means losing your backups — key handling is a real operational duty, not a checkbox
Security questions we get asked
Does Proxmox Backup Server support immutable backups?
Not as a feature, and anyone who tells you otherwise is selling something. PBS has no immutability flag, no retention-lock API, and no WORM compliance certification. Namespaces are an organisational boundary, not a lock — Proxmox added the ability to move groups and namespaces within a datastore in April 2026, which is rather the opposite of immutable. What PBS does give you is a chunk store that a backup run cannot overwrite. Real write-once behaviour has to come from the layer underneath or beside it: ZFS snapshots, or S3 Object Lock on a synced bucket.
Who holds the encryption keys?
You do. PBS performs client-side encryption on your side, so the chunks that reach our datastore are already encrypted and we have no way to read them. That is the correct arrangement, and it has a consequence worth stating plainly: if you lose the key, nobody — including us — can recover those backups. Key custody is a duty we will help you plan, not one we quietly take over.
Can your staff read our data?
Not when client-side encryption is enabled, because we never hold the key. Without client-side encryption, the data at rest is readable by whoever administers the datastore, which is us. If that matters to you — and in BFSI, healthcare, or public sector it should — enable client-side encryption and hold the key yourself. We will say so during onboarding rather than after an audit finding.
Where does the offsite copy physically sit?
Ask us for the current answer in writing for your specific contract, and we will give you the facility and the jurisdiction. We are not publishing a location on this page that might be out of date by the time you read it, and a residency claim is not something to take from a marketing page in any case — take it from your contract.
What about DPDP and CERT-In?
The honest position: the platform produces the evidence — job logs, verify results, restore reports, administrative audit trails — and where that evidence lives is a function of the deployment you choose. Retention periods, incident reporting timelines, and who reviews the logs remain your organisation's obligations. We can supply a processor addendum; ask for it as part of the contract rather than assuming it.
What happens to our backups if we cancel?
Get this in writing before you sign, from us or anyone else. The arrangement we recommend is an export window during which backups are either handed over or synced to a PBS instance you own. 'Cancel anytime' without a documented exit path is a warning sign, not a feature.
Have your current setup checked
The health check reports whether encryption is actually on, who holds the keys, whether verify jobs are passing, and when a restore was last proven. Most estates we look at fail on at least one of those.