Snapshot 10893
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Veeam’s guidance for customers affected by CrowdStrike’s content update Read More Veeam Trust Center Veeam Takes Data Security Seriously to Ensure Your Data Is Protected Industry Standards and Certifications Veeam is continuously investing, innovating, and adding to industry and regulatory credentials to help ensure your data is protected and secure. Visit Veeam's Compliance Portal (login required) for a more in-depth look at our security and compliance controls, policies, and practices, along with evidence for your risk assessments and assurance activities. SOC 2 Type 2 reviews an organization’s design of internal controls to assess compliance posture and determine whether the implemented controls meet the framework's requirements. Check out the Compliance Portal for more details. ACCESS COMPLIANCE PORTAL Login required ISO, the International Organization for Standardization, brings global experts together to agree on the best way of doing things – for anything from making a product to managing a process. ISO provides globally recognized frameworks, including for information security, cybersecurity, quality management, and data protection. These frameworks help organizations build robust security programs that align with industry and legal requirements. Check out the Compliance Portal for more details. ACCESS COMPLIANCE PORTAL Login required HIPAA / HITECH Type 2 Attestations are an independent third-party assessment that evaluates an organization’s compliance with HIPAA (Health Insurance Portability and Accountability Act) and HITECH (Health Information Technology for Economic and Clinical Health At) security, privacy, and breach notification requirements over a specific period. Check out the Compliance Portal for more details. ACCESS COMPLIANCE PORTAL Login required Veeam Backup & Replication v12.1 has obtained the Department of Defense Information Network Approved Products List (DoDIN APL) certification. This prestigious certification validates Veeam's commitment to meet the most stringent security, interoperability and supportability requirements of the Department of Defense's (DoD) complex network environments. See certificate Common Criteria (CC) is an international set of guidelines and specifications developed for evaluating information security products, specifically to ensure they meet an agreed-upon security standard for government deployments. See certificate Veeam aligns its cybersecurity program with the NIST Cybersecurity Framework (CSF), contributed to the NIST Special Publication 1800-11 (Data Integrity: Recovering from Ransomware and Other Destructive Events) and meets FIPS 140-2 compliance. See certificate FIPS 140-3 is a U.S. government standard that defines security requirements for cryptographic modules used to protect sensitive information. Validation under the Cryptographic Module Validation Program (CMVP) confirms that the module has been independently tested and meets strict standards for encryption, key management, and cryptographic operations. See certificate The Federal Risk and Authorization Management Program (FedRAMP®) provides a standardized approach to security authorizations for Cloud Service Offerings for the United States Federal Government. SEE FedRAMP STATUS Iron Bank is the U.S. Department of Defense’s central repository for hardened, containerized software artifacts that meet stringent cybersecurity standards. Being included in the repository demonstrates that Veeam Kasten solutions meet U.S. federal and defense security requirements, supporting secure deployment in government environments. VISIT IRON BANK CONTAINERS REPOSITORY The Cloud Security Alliance (CSA) STAR Registry documents and validates the cloud security controls of service providers. Being included in the registry provides transparency and demonstrates Veeam’s commitment to industry-leading cloud security practices. SEE CSA STAR REGISTRY LISTING Members of the Information Security Registered Assessors Program (IRAP) assess cloud services in compliance with Australian government cybersecurity standards. IRAP assessment enables Veeam to serve Australian government and public sector customers by meeting local regulatory requirements. ACCESS COMPLIANCE PORTAL The Cybersecurity Maturity Model Certification (CMMC) v2 Level 1 establishes foundational cyber hygiene for U.S. Department of Defense (DoD) contractors. Certification allows Veeam to participate in U.S. Department of Defense contracts, ensuring protection of federal information. ACCESS SPRS SITE Login required Texas Risk and Authorization Management Program (Texas RAMP) certifies the security of cloud services used by Texas state agencies. Certification enables Veeam to provide compliant cloud solutions to Texas public sector organizations. ACCESS COMPLIANCE PORTAL Swipe to show more of the table SOC 2 Type 2 reviews an organization’s design of internal controls to assess compliance posture and determine whether the implemented controls meet the framework's requirements. Check out the Compliance Portal for more details. Access Compliance Portal Login required ISO, the International Organization for Standardization, brings global experts together to agree on the best way of doing things – for anything from making a product to managing a process. (ISO) provides globally recognized frameworks, including for information security, cybersecurity, quality management, and data protection. These frameworks help organizations build robust security programs that align with industry and legal requirements. Check out the Compliance Portal for more details. Access Compliance Portal Login required HIPAA / HITECH Type 2 Attestations are an independent third-party assessment that evaluates an organization’s compliance with HIPAA (Health Insurance Portability and Accountability Act) and HITECH (Health Information Technology for Economic and Clinical Health At) security, privacy, and breach notification requirements over a specific period. Check out the Compliance Portal for more details. Access Compliance Portal Login required Veeam Backup & Replication v12.1 has obtained the Department of Defense Information Network Approved Products List (DoDIN APL) certification. This prestigious certification validates Veeam's commitment to meet the most stringent security, interoperability and supportability requirements of the Department of Defense's (DoD) complex network environments. See certificate Common Criteria (CC) is an international set of guidelines and specifications developed for evaluating information security products, specifically to ensure they meet an agreed-upon security standard for government deployments. See certificate Veeam aligns its cybersecurity program with the NIST Cybersecurity Framework (CSF), contributed to the NIST Special Publication 1800-11 (Data Integrity: Recovering from Ransomware and Other Destructive Events) and meets FIPS 140-2 compliance. See certificate FIPS 140-3 is a U.S. government standard that defines security requirements for cryptographic modules used to protect sensitive information. Validation under the Cryptographic Module Validation Program (CMVP) confirms that the module has been independently tested and meets strict standards for encryption, key management, and cryptographic operations. See certificate The Federal Risk and Authorization Management Program (FedRAMP®) provides a standardized approach to security authorizations for Cloud Service Offerings for the United States Federal Government. SEE FedRAMP STATUS Iron Bank is the U.S. Department of Defense’s central repository for hardened, containerized software artifacts that meet stringent cybersecurity standards. Being included in the repository demonstrates that Veeam Kasten solutions meet U.S. federal and defense security requirements, supporting secure deployment in government environments. VISIT IRON BANK CONTAINERS REPOSITORY The Cloud Security Alliance (CSA) STAR Registry documents and validates the cloud security controls of service providers. Being included in the registry provides transparency and demonstrates Veeam’s commitment to industry-leading cloud security practices. SEE CSA STAR REGISTRY LISTING Members of the Information Security Registered Assessors Program (IRAP) assess cloud services in compliance with Australian government cybersecurity standards. IRAP assessment enables Veeam to serve Australian government and public sector customers by meeting local regulatory requirements. ACCESS COMPLIANCE PORTAL The Cybersecurity Maturity Model Certification (CMMC) Level 1 establishes foundational cyber hygiene for U.S. Department of Defense (DoD) contractors. Certification allows Veeam to participate in U.S. Department of Defense contracts, ensuring protection of federal information. ACCESS SPRS SITE Login required Texas Risk and Authorization Management Program (Texas RAMP) certifies the security of cloud services used by Texas state agencies. Certification enables Veeam to provide compliant cloud solutions to Texas public sector organizations. ACCESS COMPLIANCE PORTAL Swipe to show more of the table Security & Risk Management Veeam is endlessly integrating security and risk management into every step of our business – so you can trust your data stays protected, always. Visit Veeam's Compliance Portal (login required) for a more in-depth look at our security and compliance controls, policies, and practices, along with evidence for your risk assessments and assurance activities. Products designed with Secure by Design principles prioritize the security of customers as a core business requirement, rather than merely treating it as a technical feature. Veeam has signed the Security by Design Pledge and affirmed our adherence to secure development practices. See Attestation Form RSAA login required Swipe to show more of the table Products designed with Secure by Design principles prioritize the security of customers as a core business requirement, rather than merely treating it as a technical feature. Veeam has signed the Security by Design Pledge and affirmed our adherence to secure development practices. See Attestation Form RSAA login required Swipe to show more of the table Government Access Requests: Policies and FAQs Veeam is committed to transparency and privacy. Explore how we manage government and law enforcement requests, from strict compliance procedures to customer notification policies and privacy protections under global standards. Responding to Government Request See Veeam’s official process for handling government and law enforcement data requests. Learn how we protect customer rights while maintaining full legal compliance and accountability. LEARN MORE Government Access Requests FAQs Get clear answers about how Veeam manages government access requests, the safeguards we apply, and your rights as a customer. You’ll also find our annual transparency report detailing requests received and addressed in the past year. LEARN MORE Swipe to show more of the table Responding to Government Request See Veeam’s official process for handling government and law enforcement data requests. Learn how we protect customer rights while maintaining full legal compliance and accountability. LEARN MORE Government Access Requests FAQs Get clear answers about how Veeam manages government access requests, the safeguards we apply, and your rights as a customer. You’ll also find our annual transparency report detailing requests received and addressed in the past year. LEARN MORE Swipe to show more of the table Environmental, Social and Governance At Veeam, we recognize the critical importance of environmental stewardship, social responsibility, and effective governance in creating sustainable value for our stakeholders, customers, and Veeamers. Veeam's reporting aligns with key ESG frameworks and standards such as the Global Reporting Initiative (GRI), Sustainability Accounting Standards Board (SASB), and Task Force on Climate-related Financial Disclosures (TCFD). READ REPORT Swipe to show more of the table Veeam's reporting aligns with key ESG frameworks and standards such as the Global Reporting Initiative (GRI), Sustainability Accounting Standards Board (SASB), and Task Force on Climate-related Financial Disclosures (TCFD). Read Report Swipe to show more of the table Veeam’s Commitment to Accessibility Veeam partners with Level Access, a third-party service provider that helps make websites and digital tools easier for everyone to use, including people with disabilities. As a leader in digital accessibility, Level Access works with Veeam to check our websites and apps, fix problems, and teach our teams how to make these resources more accessible. READ STATEMENT FAQs Security Responsible AI Privacy How can I obtain more information about Veeam’s security compliance and/or certifications? Visit Veeam's Compliance Portal (login required) for a more in-depth look at our security and compliance controls, policies, and practices, along with evidence for your risk assessments and assurance activities. How does Veeam ensure compliance with data protection regulations? Veeam employs a dedicated team of cybersecurity, privacy, and technical professionals to develop, monitor, and protect Veeam's solutions. All solutions are designed to meet data protection regulations. To ensure comprehensive compliance, Veeam implements robust security measures, such as advanced encryption techniques, adherence to standards like ISO 27001 and FIPS 140-2, conducts thorough vendor review and management, continuous environment monitoring and logging, and proactive threat detection and response. Are there any specific certifications or accreditations that Veeam holds for data protection? Veeam holds numerous certifications pertinent to data protection, including: ISO Certifications: 27001, 27017, 27018, 22301, and 27701 Government Data Certifications: DoDIN APL, APL SOCOM, and FIPS 140-2 Others: HIPAA / HITECH Type 2 For more information on Veeam’s certifications and accreditations, see Veeam's Compliance Portal (login required). How can I report a security concern? If you have a security concern involving a Veeam product or website, report it via the Submit a Vulnerability Report Form. Veeam will conduct a thorough investigation of each report and take appropriate action for resolution as needed. How does Veeam comply with DORA? Veeam supports the requirements of DORA through a robust resilience framework that includes advanced monitoring, incident response, continuous service availability, and regular system testing. We align with recognized standards such as ISO 27001 and SOC 2 to strengthen protection against cyber threats. Customers in the scope of DORA may request to sign the financial sector addendum by contacting their Veeam Sales Representatives. How does Veeam use AI responsibly in its products and services? At Veeam, we embrace the responsible use of AI in our products, services, and operations. We are committed to ensuring responsible AI deployment, focused on fairness, reliability, transparency, and accountability. Veeam integrates AI-powered assistants (Veeam Intelligence) within several on-premises and cloud products. These assistants help users with technical support, product configuration, and troubleshooting. Veeam adheres to responsible AI best practices, including transparency, security, privacy, and human oversight, aligning with the NIST AI Risk Management Framework and Microsoft Responsible AI principles. What ethical principles guide Veeam’s AI development and deployment? Veeam is committed to: Transparency: Informing users how AI systems work at Veeam including what data is used, how responses are generated, and what third-party services are used. Fairness & Non-discrimination: Utilizing AI models that are tested and monitored to minimize bias and avoid discriminatory outputs, where applicable. Security: Embedding industry-leading security for AI features by hosting AI models and systems in secure environments that include encryption, Role-Based Access Control, and secure communications. Privacy: Prohibiting user queries and customer backup data from being used to train generative AI models, without explicit consent. Veeam Responsible AI Training: Furthering our education of responsible AI use, including the completion of Responsible AI Training for all Veeam personnel involved in the development of AI capabilities, and following industry best-practices for AI usage. How does Veeam ensure transparency in AI? Responses from Veeam Intelligence are based on official Veeam documentation and Knowledge Base, with links provided for reference. Users are informed when AI is used and can see the sources behind recommendations. Veeam maintains a clear disclaimer about the limitations of generative AI and provides means for customers to verify the accuracy of the responses. Veeam encourages users to avoid unnecessarily sharing confidential information with AI assistants. Does Veeam use customer-provided backup data to train large language models (LLMs)? No. Veeam does not use any customer-provided backup data to train LLMs unless you explicitly opt in. How does Veeam monitor and improve its AI? Veeam conducts ongoing monitoring and auditing of AI inputs and outputs and implements regular updates and enhancements, with transparency about new features and changes. Can users opt out of or disable Veeam Intelligence? Yes. Veeam Intelligence can be disabled via product settings or by contacting your Veeam representative. For details, refer to your product's technical documentation. What are the limitations and disclaimers for using Veeam Intelligence? AI responses may not always be accurate; users should verify any recommendations before acting. Veeam leverages third party services to answer customer queries. Use of Veeam Intelligence does not require the user to input personal data and Veeam advises users to not input any personal information unless relevant. What Generative AI Models Power Veeam Intelligence? Veeam Intelligence leverages Microsoft Azure OpenAI Service for LLM capabilities (e.g., GPT-4) to answer customer queries. Azure OpenAI Service is a secure, enterprise-grade platform for deploying and managing AI models, provided by Microsoft with strict privacy, security, and compliance standards. When you interact with Veeam Intelligence, your queries are transmitted securely to Veeam’s servers and then to Microsoft Azure OpenAI Service for processing. Microsoft does not use your data submitted through Azure OpenAI for its own model training or improvement, following Microsoft’s responsible AI commitments. Does Veeam use any other third-party AI services? Yes. To further enhance Veeam Intelligence’s functionality and accuracy, selected features may use additional reputable third-party AI providers under strict security and privacy controls. Within Veeam Intelligence, third-party services are used to provide up-to-date, contextually relevant responses and knowledge Third-party AI service providers are listed in the Veeam Data Processing Addendum. Veeam ensures that any third-party provider it uses adheres to strong privacy, security, and responsible AI standards. How does Veeam ensure the privacy and security of data sent to third-party AI service providers? Only authorized data, necessary for the requested AI service, is shared. All data transmissions are encrypted. Veeam maintains strict contractual and technical controls with all third-party service providers to ensure compliance with privacy, security, and responsible AI policies. Veeam recommends that no unnecessary sensitive, or confidential customer data is included in AI queries. How does Veeam comply with the EU AI Act and other AI laws? Veeam ensures compliance with AI regulatory frameworks, such as the EU AI Act, by prioritizing ethical AI practices and governance. We have established an internal responsible AI policy and an AI use governance process to assess and mitigate risks associated with AI deployment, including evaluating our use of AI systems against high-risk AI criteria outlined in the EU AI Act. Veeam’s AI services do not rise to the level of a “Prohibited AI Activity” or “High Risk” under the EU AI Act. Our AI services are not intended to be used as a safety component of a product, nor are they covered by the EU’s harmonization legislation listed in Annex I or Annex III of the EU AI Act. As such, Veeam has Transparency obligations under Chapter IV, Article 50 of the EU AI Act. These obligations include notifying users when they are interacting with AI systems and providing clear instructions on the appropriate and intended use of AI systems. What data does Veeam process for on-premises (Veeam Data Platform (VDP)) and SaaS (Veeam Data Cloud (VDC)) products? VDP and other on-premises products: Veeam does not access your backup data and may process some personal data included in product log files once you explicitly share it with Veeam for maintenance and support. You can scrub logs of any personal and sensitive data before sharing with Veeam. VDC: Veeam processes data you store in a selected storage region offered by the selected storage provider (such as Azure or AWS); logs and backups are encrypted and stored securely. Are my VDC backups encrypted? Yes. All backups are encrypted using customer-specific keys managed in Azure Key Management Services (KMS), and access is tightly controlled. AI interactions are transmitted via secure, encrypted channels. How does Veeam protect privacy during support? Veeam minimizes personal data in shared logs and processes personal data per the Veeam Data Processing Addendum, Veeam Privacy Notice, and technical support bulletins contained in our Knowledge Base. Does Veeam sign Data Processing Addendums (DPAs)? For VDP and other on-premises products, since Veeam does not have access to your backups and therefore does not systematically process any personal data, a DPA is not required. For VDC , a DPA is incorporated by reference into the VDC Service Agreement, which each customer reviews and agrees to during deployment. Who are Veeam’s sub-processors for VDC? Veeam partners with trusted sub-processors to provide Veeam Data Cloud services. A complete and current list of sub-processors, including their locations and roles, is available within the Veeam Data Processing Addendum. Veeam performs due diligence on all sub-processors and ensures contractual commitments for data protection. How can I exercise my data subject rights (e.g., access, correction, erasure) with Veeam? You may have rights under applicable data protection laws regarding your personal data. Requests for access, correction, deletion, restriction, or portability of your personal data can be submitted by contacting privacy@veeam.com. For full details, please refer to the Veeam Privacy Notice, section “Your Data Privacy Rights.” What is Veeam’s data retention and deletion policy? For VDP and other on-premises products, Veeam retains customer-provided logs only as long as necessary for the purposes described in our Knowledge Base or as required by law. For VDC, logs are retained for up to 180 days. Backup data is retained according to your selected retention settings. Upon contract termination or at your request, Veeam deletes your data in accordance with its Data Processing Addendum and Privacy Notice. What privacy-related certifications and compliance programs does Veeam participate in? Veeam maintains a robust privacy compliance program and participates in industry-standard certifications and frameworks. Veeam is certified in ISO 27701 (Privacy Security) and ISO/IEC 27018 (Data Privacy in Cloud Computing). ISO certifications can be obtained in the certifications section of the trust center. How does Veeam legalize transfers of customer personal data outside of the European Economic Area (EEA), Switzerland, and the UK? Veeam ensures that transfers of personal data outside the EEA, Switzerland, and the UK are conducted in accordance with applicable data protection laws. Where required, Veeam relies on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, or other approved mechanisms. Veeam is also certified under the EU-U.S. Data Privacy Framework (DPF), which facilitates compliant data transfers to the United States. Furthermore, Veeam conducts Transfer Impact Assessments (TIAs) for jurisdictions such as the United States and Australia to evaluate potential risks and ensure an adequate level of protection for personal data. For more information, see the “Cross-border data transfers” section of our Data Processing Addendum and the DPF website. Can Veeam access customer data? For VDP and other on-premises products, Veeam does not have access to customer backup data by design. For VDC, Veeam does not access customer backup data unless requested to do so. Only if necessary and only with a customer’s prior consent, a limited number of Veeam support employees may access customer data to provide services and support, always in accordance with our DPA and Privacy Notice and under strict access controls. Customer data is never accessed for marketing or non-service-related purposes. Does Veeam sell or share customer backup data with third parties? Veeam commits to our Privacy Policy and will not sell your data, nor give any of your backup data to third parties (including law enforcement, other government entity, or civil litigant) except as you direct, or as required by law. How can I learn more or raise a privacy concern? Review the Veeam Data Processing Addendum, Veeam Privacy Notice, and technical product documentation. For privacy concerns, contact privacy@veeam.com Where Data & AI Trust Converge for the Agentic Era Let's Talk Request Custom Demo Verify your email to continue your product download We've sent a verification code to: An email with a verification code was just sent to Didn't receive the code? Click to resend in sec Didn't receive the code? Click to resend Start using Veeam: Download the product & Activate the license key Thank you! We have received your request and our team will reach out to you shortly. OK Oops! Something went wrong. Please, try again later.