Security & privacy
For us, security is not an extra but the foundation.
A backup contains a company's most valuable data. That is why AegisGrid has been built from the start so that data stays protected, unaltered and under German law.
Protection on every level
Encrypted before data leaves your premises
The data is encrypted on the backed-up system with AES-256-GCM or ChaCha20-Poly1305. Both methods are authenticated: a wrong key or altered data is reliably detected during the restore.
The key in your hands
The key is created and kept at your premises. Without it, an encrypted store reveals nothing about its contents – not even to whoever runs the storage.
Protected transfer
The connection to the backup server is TLS-encrypted, and its certificate is pinned. Access uses API keys that are only valid for certain directories.
Immutable backups
In WORM storage, written data is never changed; backups are locked against changes and deletion until a set point in time. That way an intact version remains even after an attack.
Separated privileges on the server
Only a few parts of the backup server run with elevated privileges; the data is processed under a separate, unprivileged account.
Signed updates
Updates and components are signed with Ed25519, packages are bound by checksums, and older versions are not installed again. Only what the signature confirms is installed.
Audit-proof evidence log
The backup server records every backup, restore, check and deletion in a chained, daily signed log – with a copy to your SIEM at once, if you wish. More about the evidence
Restore without dependence
Your licence is stored signed on your systems and works without a permanent connection to us. If it ends, only new backups stop: existing ones can still be restored from your own backup servers and destinations, and nothing is ever deleted because of a licence.
Data protection under the GDPR
AegisGrid is developed by MSD Computersysteme GmbH in Germany. In Managed Backup and the cloud storage we process your data as a processor under Art. 28 GDPR – on the basis of a contract that sets out the purpose, scope and the technical and organisational measures.
You decide where your backups are kept – on your own servers, NAS storage or at a second site, for example. If you use the AegisGrid cloud storage, the backup data is kept there exclusively in certified data centres in Germany; no data is transferred to third countries.
- Provider based in Germany
- Development in Germany
- Operation and support by our own staff in Germany
- Cloud storage in certified data centres in Germany
- Freely selectable storage locations, also only on your own premises
- Data processing agreement
- No transfer to third countries
Support with legal requirements
AegisGrid provides technical building blocks for requirements that many companies have to meet.
| Requirement | Content | What AegisGrid contributes |
|---|---|---|
| GDPR Art. 32(1)(b) | Confidentiality, integrity, availability and resilience of the systems | Encryption, authenticated methods, copies in several places |
| GDPR Art. 32(1)(c) | Timely restoration after an incident | Every version restorable on its own, a local copy for short restore times |
| GDPR Art. 32(1)(d) | Regular testing of the measures | Checks of all stored objects, automatic check restores, results by email, test restores in Managed Backup |
| NIS2 Directive Art. 21(2)(c) | Backup management and disaster recovery | Scheduled backups, immutable copies, automatic check restores and a signed evidence log with a monthly report |
| BSI IT-Grundschutz CON.3 and OPS.1.1.5 | Backup concept and logging | Records of regularity, retention, deletions and restore tests; a tamper-proof log with a copy in a second place |
No software alone fully meets these requirements – they are part of an overall concept of technology and organisation. We will gladly advise you on which measures make sense for your company. How the backup server provides evidence of backups for NIS2, critical infrastructure and BSI IT-Grundschutz is shown on the evidence page.
Questions about security or data protection?
We will gladly provide further documents, such as the data processing agreement.