--- title: "Immutable Cloud Backup | CloudRecover | Commvault " type: "WebPage" language: "en-US" url: "https://www.commvault.com/capabilities/immutable-backups" date: "2026-10-27T13:31:37-04:00" modified: "2026-10-27T13:31:37-04:00" description: "Keep immutable backups outside your AWS account. See how isolated, immutable copies work and book a demo. " image: "https://www.commvault.com/ogimage/fb/44677/" breadcrumbs: - name: "Commvault Home" url: "https://www.commvault.com/" - name: "Capabilities" url: "https://www.commvault.com/capabilities" - name: "Immutable backups" --- # Immutable Backups - [Home](/) - Capabilities - Immutable Backups Clumio Cloud Recover Capability ## Air-gapped, Immutable Protection Vault copies stay immutable, isolated, and outside your AWS account's reach. - [Try on AWS Marketplace](https://aws.amazon.com/marketplace/pp/prodview-hdul2n6jr5dou) - [Request demo](/solutions/cloud-recover/request-demo) ![](/wp-content/uploads/2026/11/fullwidth-background-generic-10.jpg) --- - [Benefits](#Benefits) - [Analyst Report](#Analyst-Report) - [Features](#Features) - [Solutions](#Solution) - [Our Reach](#testimonials) - [FAQs](#FAQs) - [Risk Assessment](#Assessment) [Get demo](/request-demo) --- See it work ## The report your auditor asks for Watch in-product reporting produce the analytics compliance teams need, straight from the backup estate. [Watch the demo](https://www.commvault.com/resources/video/clumio-demo-reporting) Play Video ![Video thumbnail](https://play.vidyard.com/zjGvreHxtBntdVxoBaMwfd.jpg) --- Why it matters ## Capability Benefits Protection that is designed to hold even when the production account does not. --- ![](https://www.commvault.com/wp-content/uploads/2026/10/Access-Controls.svg) --- ## Outside your account and its permissions Copies live in an isolated environment, helping keep a compromised account away from them. ![](https://www.commvault.com/wp-content/uploads/2026/10/Access-Tokens.svg) --- ## Immutable and indelible Backups stay immutable and indelible for the retention period you set in policy. ![](https://www.commvault.com/wp-content/uploads/2026/10/Disk-Storage.svg) --- ## Helps withstand ransomware and account compromise Isolated copies held outside production can help you restore after encryption or deletion. ![](https://www.commvault.com/wp-content/uploads/2026/10/Metric-Users.svg) --- ## Evidence to support audits Helps support SOC 2, ISO 27001 and 27701, HIPAA and GDPR requirements; FedRAMP Moderate Ready. ![](https://www.commvault.com/wp-content/uploads/2026/10/CommCell-Groups.svg) --- ## Cross-account and cross-region Restore into another account or region when the primary is unavailable. ![](https://www.commvault.com/wp-content/uploads/2026/10/HTTP-Proxy.svg) --- ## Use the copy without restoring it Applications read backup data straight from the isolated copy, with no full restore and no waiting. --- Analyst report ## Architecting Cloud Data Resilience MIT Technology Review Insights on why cloud data needs cloud-native backup, air-gapping and immutability. [Read the report](/resources/analyst-report/architecting-cloud-data-resilience) ![](/wp-content/uploads/2026/10/MIT-Review-650x650-1-scaled.png) --- How it works ## Capability Features ## Immutable, isolated storage Backups sit outside your AWS account, immutable for the retention you set. [Learn more](https://documentation.commvault.com/clumio/securevault_backup_tier_options.html) ## Encryption and key control Encryption using FIPS 140-3 validated cryptographic modules in transit and at rest, with bring-your-own-key support. [Learn more](https://documentation.commvault.com/clumio/encryption.html) ## Cross-account, cross-region recovery Restore to a different account or region for disaster recovery. [Learn more](https://documentation.commvault.com/clumio/restore.html) ![](/wp-content/uploads/2025/08/Why-Partner_StatsOverview_650x650-2.jpg) --- ## Related to this capability --- ai recovery Solution ## Clumio CloudRecover Recovery built for the cloud. Proven at scale. Ready for AI. [See CloudRecover](/solutions/cloud-recover) ![](/wp-content/uploads/2026/10/clumio-cloud-recover-thumbnail-888x500-1.jpg) --- ![](https://www.commvault.com/wp-content/uploads/2026/10/Cloud-Environment.svg) --- ## In-place rollback at cloud scale Roll back S3, DynamoDB, and Apache Iceberg data to the point before the damage. [Learn more](/capabilities/cloud-scale-rollback%20) ![](https://www.commvault.com/wp-content/uploads/2026/10/Index-Servers.svg) --- ## Threat and ransomware detection Helps you spot ransomware patterns in backups. Get a verdict on each backup with detection enables, with the evidence behind it. [Learn more](/capabilities/threat-and-ransomware-detection) ![](https://www.commvault.com/wp-content/uploads/2026/10/Cloud-Configuration.svg) --- ## Built for Cloud Developers Protection declared in code, driven by API, operable by AI agents. [Learn more](/capabilities/built-for-cloud-developers) --- Our Reach ## Supporting more than 100,000 companies Trusted by teams whose auditors, insurers and boards ask where the copy lives. - ![](/wp-content/uploads/2025/08/logo__adidas.png) - ![](/wp-content/uploads/2025/08/logo__sony.png) - ![](/wp-content/uploads/2025/08/astra-zeneca-case-study.png) - ![](/wp-content/uploads/2025/08/logo__merck.png) - ![](/wp-content/uploads/2025/08/logo__randstad.png) - ![](/wp-content/uploads/2025/08/logo__panasonic.png) --- > “Clumio does not consume any resources, and it does not affect our infrastructure. Yet it grows as much as we need it to. As much as our data grows, Clumio will serve that purpose. ” > > Dimitar Aleksiev > > Director of IT, CAVA Group > “Clumio solves a really important problem for us – providing the peace of mind that if we had a catastrophic failure or ransomware event, we will be able to get back up and running. ” > > Aaron Budge > > VP Production Engineering and IT, Parchment --- ## Frequently Asked Questions What does air-gapped mean for a cloud backup? It means the copy is held in an environment separate from your production account, with controls designed to help protect it from production-account credential compromise. The copy is immutable for its retention period and is reached through CloudRecover’s controlled access and recovery workflows. Can someone with my cloud credentials delete my backups? Isolation helps protect backups from compromised production credentials. Backups are stored outside the production account and are immutable for the retention you set. A compromised account, a malicious insider or a mistaken script faces controls designed to help protect the backups, which is the point of keeping the copy outside the production account. Where is my backup data stored? In an isolated environment managed by CloudRecover, separate from your production account, a supported region you choose. Data is encrypted in transit and at rest with FIPS 140-2 validated encryption, with the option to bring your own keys. How long can I retain backups? As long as required by your policy. Retention is set per policy, and an archive tier keeps long-term history at archive pricing while helping limit effects on the live estate, which is how regulated customers meet multi-year requirements. Does the vault support our compliance requirements? It can help support applicable requirements. CloudRecover is covered by a SOC 2 Type II report and certified to ISO 27001 and ISO 27701, supports HIPAA and GDPR requirements, uses FIPS 140-2 validated encryption, and is FedRAMP Class C (Moderate) Ready. Audit evidence exports in the formats auditors expect. --- Data Risk Assessment ## Are your cloud workloads at risk? CloudRecover helps you find and fix data vulnerabilities to strengthen recovery readiness. Get a CloudRecover Data Risk Assessment to uncover risks in your cloud environment and gain a roadmap to stronger resilience. [Request assessment](/solutions/cloud-recover/data-risk-assessment) ![](/wp-content/uploads/2025/08/Data-Risk-Assessment-Hero-1.png)