Skip to main content Skip to navigation Skip to footer

Free download · A4 PDF · CISO / CTO grade

Encryption Control

Schrems II isn't a policy choice. It's a design requirement, and most backup vendors fail it.

Get the technical brief

A no-fluff PDF written for CISOs, CTOs, and senior engineers. We send the link by email so it is easy to find again.

One email. Confirmation by mail. Unsubscribe with one click.

What's inside

Inside: what it protects against and how it works. Which rules it helps meet. The proof an auditor will want. About 10 to 14 dense pages.

  1. What the real threat is, in plain terms
  2. How the system works, and why an attacker can't beat it
  3. What it stops, with real-world examples
  4. Which rules apply: fines, deadlines, exact wording
  5. The cost math, grounded in published numbers
  6. How we stack up against other vendors on the tech, not the price tag
  7. What setup looks like, and what we don't cover
  8. The evidence an auditor will ask for

Related solution pages

The same approach, framed for the questions that come up:

Migrate without risking the data

Switching servers, clouds, or providers? Backups stay locked the whole way. No data exposed. None lost.

Read more

Own the keys. Own the encryption. No exceptions.

Every backup is encrypted with locally owned keys. Not the vendor's keys. Not shared keys. One owner only.

Read more

Every action logged. Nothing hidden.

See who did what, when, and why. Every action lands in a record nobody can fake.

Read more

Sovereign by design, not by certificate.

It runs on local servers. The only keys stay local. A US-owned provider can't hand over data it never had.

Read more

Questions readers asked

Who is this brief written for?

A CISO, CTO, or senior infrastructure engineer reviewing the design. It assumes working knowledge of backups, storage, and the rules the stack already has to follow.

Is there a non-technical version?

Yes. After the email is submitted, the same page links to a five-minute executive PDF, ready to forward to a CFO, IT director, or board member.

What happens to my email?

One confirmation email, plus our newsletter (one short post per month, all-product). Unsubscribe with one click. Email addresses live in the EU by default per Rediacc's data-residency policy.

Why btrfs?

The brief covers this in depth. Short version: btrfs puts write-once copies and instant clones into the storage layer itself. Not into an app on top. The send/receive feature ships those copies off-machine. So an attacker holding the top admin password can't change or delete them.

Does this apply to managed services like AWS RDS?

Not directly. The design covers self-hosted servers running databases in Docker on btrfs storage. When critical data lives in RDS or Aurora, the brief flags that. It then shows where the model fits and where it doesn't.

About this brief

Rediacc is a Tallinn-based company. We build backup and disaster recovery on btrfs and commodity Linux. Our engineering team wrote this brief. We edited it against an anti-slop style guide. Then we checked every claim before publishing.

Have a question we should add to this page? Tell us at hello@rediacc.com.

Download short brief (PDF)