18. Security and compliance FAQ

Narrow language always. Say “supports”, “provides”, “available on request”. Never “certified for HIPAA”.

Source for this section unless noted: backblaze.com/cloud-storage/compliance and /cloud-storage/security, docs on SSE, Object Lock, app keys (checked 2026-10-14).

Q1. What certifications does Backblaze hold? SOC 2 Type 2 (independent third-party audit). Data centers are also SOC 2 compliant. Listed status: GovRAMP Progressing Snapshot, TX-RAMP Provisional, TPN Blue Shield, HECVAT lite and full v3.06 completed, VPAT (Section 508), Internet2 Cloud Scorecard completed. ISO 27001 applies to the data centers Backblaze primarily operates in, not to Backblaze itself; say it that way.

Q2. HIPAA? Backblaze provides a Business Associate Agreement (BAA) on request for business customers who are covered entities. Compliance remains shared responsibility.

Q3. GDPR? Backblaze adheres to GDPR and UK GDPR; Data Processing Addendums for EEA/EU and UK are available. EU Central region (Amsterdam) for residency.

Q4. PCI DSS? Backblaze uses Stripe for card data and states its controls contribute to PCI DSS adherence. That is about Backblaze’s billing, not a PCI attestation for storing cardholder data in B2. Customers storing PAN must apply their own controls (encrypt with SSE-C or client-side).

Q5. FedRAMP? Not listed. GovRAMP Progressing and TX-RAMP Provisional are the government statuses.

Q6. How is data encrypted at rest? SSE-B2 (AES-256, unique per-file key wrapped by a global key) is applied by default to new uploads since Sep 14 2026. SSE-C lets the customer supply the key per request. Files uploaded before default encryption remain as they were unless rewritten. [ask Backblaze whether existing unencrypted objects are being backfilled]

Q7. In transit? HTTPS/TLS endpoints for S3 and Native APIs. [verify minimum TLS version in docs]

Q8. Can Backblaze employees read my data? With SSE-C, Backblaze does not retain the key. With client-side encryption (e.g., rclone crypt, backup software encryption), Backblaze only stores ciphertext. Recommend client-side or backup-software encryption for maximum separation.

Q9. How does immutability work? Object Lock: governance or compliance retention 1 to 3,000 days, plus legal hold. Compliance mode cannot be shortened or removed by anyone. Enabled per bucket, irreversible on that bucket.

Q10. How do we enforce least privilege? Standard application keys scoped to bucket(s), prefix, capabilities, and expiry. Up to 100M keys per account. Master key only for account-level and Partner API work. No IAM roles in the S3-compatible API.

Q11. MFA and SSO? MFA available for accounts. Computer Backup Business supports Google/Microsoft SSO; Enterprise Control supports OIDC (Okta, Entra ID). B2 Neo advertises SSO integration for operators. [verify B2 console SSO options for enterprise B2 accounts]

Q12. Audit logging? Bucket Access Logs are listed as a security feature. Event Notifications can feed a SIEM via webhook.

Q13. Physical security? Data centers staffed 24/7/365 with “best-in-class security features” per Backblaze. Specific controls are in the SOC 2 report via Whistic.

Q14. How do we get the SOC 2 report and questionnaires? Whistic profiles: Education Industry, EU Customers, All Other Customers.

Q15. Where is my data? Only in the region chosen at account creation (US West, US East, EU Central, CA East) unless you replicate it. Region cannot be changed.

Q16. Durability vs availability? Durability: designed 11 nines via 17+3 erasure coding across 20 pods. Availability: governed by SLA. [pull current SLA document and uptime commitment before quoting]

Q17. Ransomware insurance questionnaires ask for “air-gapped” backups. Is B2 air-gapped? Say “logically air-gapped / virtually air-gapped”: off-site, separate credentials, and immutable via Object Lock. Not a physical air gap. Backblaze marketing uses “virtually air-gapped”.

Q18. Can we restrict access by IP or private network? Overdrive includes private networking integration. [verify IP allow-listing options for standard B2]

Q19. Data deletion on exit? Customer deletes objects; locked objects persist until retention expires. [verify media sanitization statement in SOC 2 / policies]

Q20. TPN for studios? TPN Blue Shield aligned with MPA Content Security Best Practices.

Q21. Education? HECVAT completed; Internet2 Peer Exchange connectivity; multiple university case studies.

Q22. Penetration testing / bug bounty? [unverified; check Trust Center]