--- title: "Managed Backup for VMware - Security and guarantees of your backups" description: "Discover the security measures of Managed Backup for VMware, what each Backup plan guarantees and how responsibilities are shared between you and OVHcloud" url: https://docs.ovhcloud.com/pl/guides/storage-and-backup/managed-backup-for-vmware/security lang: en lastUpdated: 2026-11-03 --- > For AI agents: the complete documentation index is available at https://docs.ovhcloud.com/pl/llms.txt, the full documentation bundle is available at https://docs.ovhcloud.com/pl/llms-full.txt. # Managed Backup for VMware - Security and guarantees of your backups ## Objective Managed Backup for VMware protects your backups against loss, human error and ransomware attacks. **This guide describes the security measures in place, what each Backup plan guarantees, and how responsibilities are shared between you and OVHcloud.** ## Requirements - None: this guide is an overview of the guarantees of the service. ## Instructions ### Encryption - **On all three Backup plans, without exception:** all backups are encrypted. Encryption cannot be turned off. - **Before leaving the backup server:** data is encrypted on your VBR, before it is written to the backup storage. - **One key per service:** each protected infrastructure has its own key, never shared with another service or another customer. - **A key managed by OVHcloud:** it is generated and kept in OVHcloud's database. You never hold it or see it: it does not appear in any interface, any email or any API response. - **The backup of the server itself** is encrypted in the same way. ### Immutability On the **Advanced** and **Premium** plans, each restore point is immutable for **14 days** from the time it is written. It cannot be modified or deleted, by anyone. This also applies to OVHcloud, and to an attacker who has obtained your credentials. - Immutability is active by default, from the first backup, with no action on your side. - It relies on object storage locking, not on a VBR setting. - Any attempt to delete a restore point under immutability fails. **Note:** **Immutability and retention are two different durations** On Advanced and Premium, a restore point is kept for 35 days, and the first 14 of them are under immutability. Between day 15 and day 35, it still exists but is no longer locked. The Standard plan has no immutability. ### Copy to a secondary site Advanced and Premium backups are replicated to the **secondary site** you choose when you order, in an OVHcloud region other than that of your infrastructure. - The copy never leaves its geographical area: an infrastructure in Europe replicates in Europe, an infrastructure in Canada replicates in Canada. - If the primary site is unavailable, contact support: OVHcloud rebuilds your backup server, and you can then restore from the copy. - OVHcloud monitors replication lag. - The secondary site cannot be changed after the order. You choose the secondary site when you order, among the regions offered for the location of your infrastructure. The region recommended by OVHcloud is preselected: | Location of your infrastructure | Recommended secondary site | Other sites offered | | ------------------------------- | -------------------------- | --------------------------------------------------------------- | | Roubaix (RBX) | Strasbourg (SBG) | Gravelines (GRA), Limburg (LIM), Erith (ERI), Warsaw (WAW) | | Strasbourg (SBG) | Roubaix (RBX) | Gravelines (GRA), Limburg (LIM), Erith (ERI), Warsaw (WAW) | | Limburg (LIM) | Warsaw (WAW) | Roubaix (RBX), Strasbourg (SBG), Gravelines (GRA), Erith (ERI) | | Erith (ERI) | Roubaix (RBX) | Strasbourg (SBG), Gravelines (GRA), Limburg (LIM), Warsaw (WAW) | | Warsaw (WAW) | Limburg (LIM) | Roubaix (RBX), Strasbourg (SBG), Gravelines (GRA), Erith (ERI) | | Beauharnois (BHS) | Toronto (TOR) | None | | Toronto (TOR) | Beauharnois (BHS) | None | ### Long-term retention (Premium) The Premium plan also keeps **11 monthly points**, about one year of history. Use them to recover a state from several months ago, or to meet a retention obligation. ### Isolation and access - **A dedicated backup server:** each infrastructure has its own VBR, never shared with another customer. - **An account with limited rights:** your VBR account lets you back up, restore and view. It cannot modify jobs, change the configuration or delete an immutable backup. - **A password you choose:** the initial password is only sent through a single-use link, and must be changed at first login. OVHcloud does not keep the password you then choose. - **A temporary support account, if needed:** when support steps in, OVHcloud can create a temporary support account on your VBR. It is separate from your VBR account, limited to your service and deleted when it expires, and every request is logged. - **No direct access to storage:** OVHcloud provisions and operates the backup storage, and gives you no storage credentials. ### Platform recovery OVHcloud backs up your backup server itself, in your secondary site. If the server is lost, OVHcloud rebuilds it. The rebuilt server reads all your existing backups again, with no loss of restore points. Its jobs resume according to your tags, with no action on your side. If the region that hosts your backup server is lost, OVHcloud restores your backup and restore capacity. The recovery time objective (RTO) is 24 hours. The recovery point objective (RPO) is 24 hours, that is, at most one scheduled backup. ### Who is responsible for what | OVHcloud | You | | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | • Deploy, update and monitor the VBR and its proxies
• Create and schedule the backup jobs
• Encrypt, store, replicate and lock the backups
• Add proxies if your estate requires it
• Rebuild the backup server after a failure | • Choose the Backup plan of each machine, by tag
• Re-tag the restored machines you keep
• Protect the password of your VBR account
• Monitor the last backup dates in the OVHcloud Console and the notifications of your VBR, sent by email to the address of the OVHcloud account that ordered the service
• Test your restores regularly | ## Go further [Getting started with Managed Backup for VMware](https://docs.ovhcloud.com/pl/guides/storage-and-backup/managed-backup-for-vmware/getting-started.md): the three Backup plans in detail. [Backing up and restoring from the VBR console](https://docs.ovhcloud.com/pl/guides/storage-and-backup/managed-backup-for-vmware/backup-restore.md): test a restore. Join our [community of users](https://community.ovhcloud.com/).