As experts in data backups, security is at the core of what we do.

We store your backup data in one of 9 AWS regions: EU (Ireland), Germany, UK, US, Canada, Australia, Singapore, Brazil or Israel. The closest region is pre-selected when you connect your first app (EU customers default to Ireland, German customers to Frankfurt), and you can pick another one. Contact support if you want to change it later. The application that runs your backups, and its databases with account details and backup metadata such as workspace structure, run on AWS in Ireland (eu-west-1). All AWS data centres are certified to industry standards including ISO 27001, SOC 1 and SOC 2, and PCI DSS Level 1, and feature advanced physical security: 24/7 CCTV monitoring, intrusion detection, access logging, redundant power, fire suppression, and water leakage detection.

We enforce strict access control policies, requiring multi-factor authentication (MFA) for production databases and networks, restricting privileged access to authorized personnel only, and revoking access promptly upon termination. All data encryption keys and production systems are securely managed to minimize risk.

Our infrastructure undergoes continuous monitoring, with tools for intrusion detection, performance tracking, log management, and vulnerability assessments. Additionally, network segmentation, firewall protections, and regular system hardening ensure our infrastructure remains resilient against threats. More details on AWS security practices are available at AWS Compliance Programs

We enforce strict asset disposal procedures, maintain a detailed inventory of production systems, and deploy up-to-date anti-malware technology.

All employees and contractors undergo background checks, sign confidentiality agreements, and adhere to our Code of Conduct, which is acknowledged at hire and strictly enforced. We conduct annual performance evaluations and implement a robust password policy. Mobile devices are managed centrally using Mobile Device Management (MDM) systems, while visitors to secure areas follow stringent sign-in and escort procedures. Employees complete security awareness training during onboarding and annually to stay informed of best practices.

All sensitive customer data is encrypted at rest using AES-256, with cryptographic keys managed by AWS Key Management Service (KMS). Data in transit is protected with TLS, and HTTP Strict Transport Security (HSTS) ensures browsers only ever connect over HTTPS.

We conduct annual control self-assessments and penetration testing, implementing remediation plans for identified vulnerabilities within defined SLAs. Our formal policies include robust vulnerability management and system monitoring procedures to proactively address potential risks and maintain the integrity of our systems.

We maintain comprehensive Business Continuity and Disaster Recovery Plans to ensure operations during unforeseen events and hold cybersecurity insurance for financial protection. Access to production deployments is strictly limited to authorized personnel, and our formal systems development life cycle (SDLC) governs all changes to our systems.

We conduct regular access reviews and require documented approvals for access requests to maintain appropriate access controls. Our security policies are reviewed annually, and incident response policies are in place to handle and resolve security or privacy incidents efficiently. Vulnerability scans are performed quarterly, with critical findings promptly remediated. Additionally, users can report issues through our external-facing support system, and our whistleblower policy provides an anonymous channel for reporting concerns.

Our data retention and disposal procedures govern the secure storage and removal of customer data, including the permanent deletion of confidential information when you leave our service. We also follow a data classification policy to ensure sensitive data is secured and accessible only to authorized personnel. For more details, refer to our Privacy Policy.

ProBackup operates as both a data processor and a data controller, depending on the context. As a data processor, we handle personal data on behalf of our customers, who remain responsible for determining the purpose and means of processing. Customers can formalize this relationship by signing our Data Processing Addendum (DPA). As a data controller, we manage personal data about our customers and adhere to policies outlined on our website to ensure compliance with data protection regulations, including the GDPR.