Security
Secure cloud storage
that locks your backups.
Encryption keeps strangers from reading your data. Object Lock stops anyone from deleting it. Stornox gives you both, plus version history and storage spread across nodes in India.
- AES-256
- Object Lock
- Versioning
- Erasure coding
How data is protected
Six controls, each doing one job.
Encryption in transit
Every API call travels over TLS between your systems and Stornox.
tlsEncryption at rest
Stored data is encrypted with AES-256. Client-side encryption keeps the keys with you.
aes-256S3 Object Lock
Write-once retention in compliance or governance mode, per bucket or per object.
object lockVersioning
Each change creates a new version, so you can roll back a bad overwrite or a deletion.
versioningErasure-coded storage
Objects are split into coded fragments across storage nodes in India. One failed node does not lose data.
distributedPer-application keys
Each tool gets its own access key limited to its own buckets. One leaked key cannot reach everything.
least privilegeRansomware
Why the backup is the real target.
If you can restore, the ransom note loses its power. Attackers know this, so they look for the backups before anything else.
What usually happens
- Someone gets in with a stolen or weak password
- They spend days finding backup servers and storage
- Backups are deleted, encrypted, or their retention is cut
- Only then are production systems encrypted
What a locked copy changes
- Locked backups cannot be deleted or overwritten during retention
- Compliance mode cannot be switched off by any user
- Earlier versions stay available
- You restore from a known clean copy and move on
Most backup tools, including Veeam, can write immutable backups to S3-compatible storage. Setup notes: Veeam and other backup software. For more depth, read our blog on immutable storage for ransomware protection.
Recommended settings
How we would set up a backup bucket.
- 1
Decide on Object Lock up front
Choose which buckets need it before you create them, and switch it on at creation.
- 2
Pick a sensible retention
14 to 30 days covers most operational backups. Regulated records may need years.
- 3
Give backups their own key
The backup app gets a key that only reaches its buckets. Nobody else uses it.
- 4
Protect console logins
Long unique passwords and multi-factor authentication for every person with access.
- 5
Keep more than one copy
Three copies, two kinds of media, one somewhere else. The 3-2-1 rule still works.
- 6
Restore something every month
Pick a file, a folder or a VM and bring it back. Untested backups are a guess.
For your security team
Need documents for a vendor review?
We send current certificates, a security overview and our data processing agreement on request. Contact sales or call +91 91751 11820.
FAQ
Questions we get asked.
What is immutable storage?
Storage where data, once written, cannot be changed or deleted until a set date. On Stornox this is done with S3 Object Lock.
How does Object Lock help against ransomware?
Ransomware crews try to delete or encrypt backups before they hit production, so you have no way back. Backups locked in compliance mode cannot be changed or deleted before their retention date, even with valid admin credentials. You still have a clean copy to restore.
Compliance mode or governance mode: which should I use?
Compliance mode cannot be overridden by anyone until the retention period ends. Governance mode lets specially authorised users remove the lock. For ransomware protection, compliance mode is the safer choice; governance mode suits testing.
Is my data encrypted?
Yes. Traffic to Stornox uses TLS, and stored data is encrypted with AES-256. You can also encrypt on your side before upload so that only you hold the keys.
Can I see your certifications?
Yes. Ask sales for our current certificates and security documentation and we will send them across.
Is Object Lock enough on its own?
No. It protects the copies you store. You still need regular backups, more than one copy, tested restores and tight access to the backup software itself.
No technology removes all security risk. The controls on this page reduce risk when they are set up correctly and used as part of a wider security programme.
Related
Read next.
Get in touch
Want our security pack?
Send us your questionnaire or ask for our documents. We reply within one business day.
Prefer to call? +91 91751 11820 · hello@stornox.com
