Skip to content

Security

Security at AlreadyBack.

Active resilience starts with security we can prove, not just claim. Here is what is in place today, what is coming, and how to reach us if you find something.

Controls

Encryption

  • AES-256-GCM for all backup data at rest.
  • TLS 1.3 in transit, with Post-Quantum readiness (PQC auto via Cloudflare).
  • Optional BYOK (customer-held keys) on the Immunity plan — we never see your data in the clear.

Infrastructure

  • Defense-in-depth compute infrastructure hardened to industry baselines.
  • Default-deny network posture at every layer.
  • Principle of least privilege enforced on all deployed services.
  • Immutable, cryptographically-pinned production releases.

Backups and recovery

  • Multi-tier backup architecture with immutable offsite storage (WORM-locked, 30-day minimum retention).
  • Restore drills validated quarterly against full production workloads.
  • Sub-5-minute recovery time objective (RTO) — measured, not aspirational.

Multi-region

  • EU-West: live today.
  • US-East: Q2 2026.
  • APAC (Singapore): Q3 2026.
  • Enterprise clients on Immunity can replicate backups across multiple regions.

Custom regions, on-premise, and air-gapped deployments available for enterprise. Contact us.

Monitoring

  • Continuous observability with real-time metrics, dashboards, and centralized logs.
  • Behavioral threat detection at the edge.
  • 24/7 alerting — critical events wake a human, not a queue.
  • Every production build scanned for vulnerabilities before deployment.

Compliance

  • SOC 2 Type II: in progress, target H2 2026.
  • GDPR-compliant by design: EU representative, pre-signed DPA with SCCs, public sub-processor list.
  • CCPA-compliant: rights to know, delete, opt-out, and non-discrimination.
  • EU Cyber Resilience Act (CRA) reporting ready before the September 2026 deadline.

Detailed architecture, vendor list, and third-party audit evidence are available to enterprise prospects under NDA. Contact [email protected].

Report a vulnerability.

Found something that could compromise our customers? Tell us. We triage every report in good faith and will not take legal action against researchers who follow good- faith disclosure: contact us first, give us a reasonable time to fix, and don't access data beyond what's needed to demonstrate the issue.

Security contact
[email protected]

PGP fingerprint coming soon.

Download PGP key (coming soon)

Response times

  • Acknowledgment: within 48 hours.
  • Triage: within 7 days.
  • Fix SLA: critical 30 days, high 60 days, moderate 90 days.

Machine-readable disclosure policy: /.well-known/security.txt (coming soon, paired with the PGP key).