Security at AlreadyBack.

• ·AES-256-GCM on every backup, encrypted before it leaves for storage — providers only ever hold ciphertext.
• ·TLS 1.3 for all data in transit.
• ·Per-organization keys — cryptographic tenant isolation, not just logical separation.
• ·In managed mode our systems are technically able to decrypt your backups — used only to run the operations you request, and restricted and logged. Bring your own key to remove that ability.
• ·Bring your own key (BYOK) on Resilience: you supply the key, we hold it sealed and use it only for your operations, and you rotate or revoke it anytime — revoking it cryptographically renders the corresponding backups unrecoverable, an instant erasure you control.

• ·Compute infrastructure hardened to documented baseline configurations.
• ·Layered network segmentation and least-privilege access across all services.
• ·Immutable, integrity-verified production releases — every deploy is a pinned, verified artifact, so what we test is exactly what runs.
• ·Every change is peer-reviewed, automatically checked, and vulnerability-scanned before it ships.

• ·Least-privilege access to production — granted only when it is needed.
• ·Multi-factor authentication required on privileged accounts.
• ·Administrative access is restricted, logged, and reviewed periodically.
• ·On your side: single sign-on with your identity provider — included with Resilience.

• ·Daily encrypted backups, kept in the region you choose.
• ·A monthly Fire Drill dry-runs a full recovery and verifies that records, relationships, and computed fields come back intact.
• ·A verification report on every backup and every restore — you see exactly what was captured or written.

• ·Pick your storage region at onboarding: United States or European Union.
• ·Your encrypted backups stay in the region you choose — never permanently stored outside it.
• ·The systems that run backups process data transiently in the United States; the stored copy stays in your chosen region. Your account data is held in the United States.

Specific data-residency requirements? Talk to us about enterprise options.

• ·Continuous security monitoring and threat detection.
• ·Critical alerts go straight to a human, not a ticket queue.
• ·Centralized logging of security events, retained for investigation.
• ·Incident notification: if a breach affects your data, we notify you within 24 hours of confirming it, with an update within 72 hours.

• ·GDPR: we process your data as your processor under a DPA with the EU Standard Contractual Clauses and the UK Addendum — EU or US residency, your choice.
• ·CCPA / CPRA: know, delete, correct, and opt out — and we never sell or share personal data.
• ·No AI or ML ever processes your backed-up content — contractually committed in our Terms and DPA.
• ·A published sub-processor list, with 30 days’ notice before any change.
• ·Data we refuse by design: health, children’s, biometric, regulated-financial, and consumer-health data.

Details on the compliance, DPA, and sub-processors pages.