Backup for NIS2, PCI-DSS and ISO 27001 compliance — Client encryption + air-gap
Your backups check all the boxes: encrypted by your servers, inaccessible to our team, physically isolated from the network.
3 security pillars
Each protection layer works independently. Even if one is compromised, the other two protect your data.
Client-side encryption
AES-256 — the key never leaves your Proxmox servers. NimbusBackup stores data it cannot read.
- AES-256 encryption by Proxmox VE before sending
- Encryption key exclusively on the client side
- NimbusBackup never has access to data in clear text
Zero admin client option
Your PBS account is in append-only mode: you can backup, read, and restore, but you cannot add accounts or delete backups.Why this segregation matters →
- Deletions only via support ticket + validation
- Protection against malicious insider on client side
- No backup modification without validation process
Physical air-gap
2 disks are physically disconnected from the network at all times, i.e. 2 months of offline backups. Even in case of complete RDEM infrastructure compromise, these copies are intact.
- Guaranteed monthly rotation, 2 disks offline (M-1 and M-2)
- Network-inaccessible — no ransomware can reach them
- Offline backup: "indispensable" per ANSSI (R12)
Already with a Single Drive PBS
Even our entry-level plan (Single Drive PBS at 12EUR/TB) with the zero admin client option already provides very satisfactory guarantees:
To go further: the air-gapped plans add an ultimate physical protection layer.
Compliance mapping — NIS2, PCI-DSS, ISO 27001
| Requirement | NIS2 | PCI-DSS | ISO 27001 | NimbusBackup |
|---|---|---|---|---|
| Data encryption | Art. 21 | Req. 3.5.1 | A.8.24 | Client-side AES-256 via PVE (optional) |
| Access separation | Art. 21 | Req. 7 | A.8.3 | Append-only client account, zero admin |
| Malicious insider protection | Art. 21 | Req. 7 | A.8.2 | Deletions via ticket + validation |
| Ransomware resilience | Art. 21 | Req. 5 | A.8.7 | Immutability + physical air-gap |
| Offsite backup | Art. 21 | Req. 9.4.1 | A.8.13 | Datacenter separate from production |
| Business continuity | Art. 21 | Req. 12.10 | A.5.30 | Tested, documented restores |
| Data integrity | Art. 21 | Req. 10 | A.8.16 | Checksums re-verified every 30d |
| Data sovereignty | — | — | A.5.31 | Servers in our own Paris racks or rented from French or European hosting companies, no transfer outside EU by default, France on request |
The evidential value of these controls — logging and traceability (PCI Req. 10, ISO A.8.15) — relies on trustworthy, NTP-synchronised timestamps: see the NTP audit checklist for CISOs, and to keep the evidence month after month, the monthly sealed NTP compliance report (Time Evidence).
What ANSSI actually asks for: R11 and R12
ANSSI's recommendations carry no normative force — the guide says so itself — but they are the yardstick auditors and cyber-insurers reach for in France. Two of them bear directly on an offsite backup offering, in the guide "Sauvegarde des systèmes d'information — Les fondamentaux" (ANSSI-BP-100, v1.1, 27 November 2025; quotations are our translation).
"3 distinct copies of the data, i.e. the production data plus 2 backups stored on different media, of which 1 offline." Three digits, not five: the 3-2-1-1-0 extension comes from CISA and ENISA, not from ANSSI.
"An offline backup is indispensable (or at least an online off-site one, under certain conditions), even if it is less frequent than regular local online backups." Indispensable, not recommended — and offline first, online off-site as the fallback.
The direct consequence for our own plans, and we would rather write it ourselves: an online-only backup, immutable or not, ranks second in the guide — "an offline backup solution is still considered more robust than an online WORM solution". The very next sentence of the same table opens the door, and that is the one to keep:
"Nevertheless, an acceptable compromise can be to run regular backups with a WORM solution and to run offline backups at a lower frequency."
That is word for word the architecture we deploy: an immutable PBS datastore for the daily cadence, and on top of it a rotation of disconnected media — AirGapped Drive, Drive Bank, Magnetic Bank — at a lower frequency. An offering that stops at online WORM only ticks R12 through the "online off-site, under certain conditions" fallback.
Scenario: compromise
Level 1 — Attacker compromises the client
They take control of your Proxmox servers, encrypt your VMs with ransomware.
They try to delete your NimbusBackup backups — the client account cannot (append-only); deletion is reserved to the operator, by ticket.
They keep read access (the token and the encryption key are on your server), but they cannot directly delete any backup: deletions go through the operator or the automated retention jobs, following defined rules.
Result: restore possible from NimbusBackup.
Level 2 — Attacker compromises RDEM Systems
In the unlikely event that RDEM admin workstations are compromised.
The attacker destroys online backups.
But: air-gapped disks are physically disconnected from the network — inaccessible, intact.
Result: air-gapped copies allow restore.
Which plan for which compliance level
| Protection | Single Drive | Double Drive | AirGapped | Drive Bank | Magnetic | Magnetic Bank |
|---|---|---|---|---|---|---|
| Client AES-256 encryption | option | option | option | option | option | option |
| Append-only + insider protection | ||||||
| Offsite separate datacenter | ||||||
| 2-site geo-replication | — | — | — | — | ||
| Physical air-gap | — | — | — | |||
| Bank vault | — | — | — | — | ||
| LTO tape archiving | — | — | — | — | ||
| Hosting provider compromise protection | — | — | — | |||
| Ultimate protection | — | — | — | — |
Compare in detail: All pricing | Managed Proxmox Backup
FAQ — Compliance
Secure your backups — the technical building blocks of compliance
Client-side encryption, append-only, physical air-gap. NIS2, PCI-DSS, ISO 27001.