Own the keys. Own the encryption. No exceptions.
Every backup is encrypted with locally owned keys. Not the vendor's keys. Not shared keys. One owner only.
Vendor-managed keys belong to the vendor
Here's the part nobody says out loud. Most backup tools encrypt data with their keys, not the customer's. So they can open it. Their staff can open it. If they get hacked, the data is wide open. Whoever controls the keys controls the data.
What does weak encryption governance cost?
Drag the sliders to match the environment. See the real cost of vendor-managed encryption.
One command. Total control.
Generate
Run rdc keygen production. This makes a 4096-bit key pair that never leaves the machine. No one else gets a copy.
Encrypt
Every backup gets locked with AES-256-GCM using that key. Data stays encrypted on disk and on the move. It happens automatically.
Control
We never see the key. We never see the raw data. Only the key holder can unlock it. That's what zero-knowledge means: we hold nothing.
Why vendor-managed encryption fails
When the vendor holds the keys, they can open the data. Their staff can too. One breach on their side and everything spills out. We do it the opposite way. The keys stay with the customer. We never see raw data or keys. Honestly, that's how it should have always worked.
Why vendor-managed encryption fails
| Vendor-held keys | Rediacc (customer-held keys) |
|---|---|
| Vendor holds the keys, so they can open the data | Keys stay local, so only the owner can open it |
| Keys shared across many customers | A separate key for each app, on local servers |
| One vendor breach exposes all the data | Zero-knowledge, so a breach finds nothing usable |
| Changing keys needs the vendor's help | Rotate keys with one command. Every read is verified, so tampering shows up immediately. |
Short on time?
Skip the deep-dive. Grab the five-minute version, short enough to read at a stand-up.
Download short brief (PDF)Encryption control compared
Most backup tools encrypt data with their keys. That's not customer encryption. That's vendor encryption.
Encryption control compared
| Capability | Veeam | Rubrik | Commvault | Druva | Rediacc |
|---|---|---|---|---|---|
| Customer holds the encryption keys | Via KMS | Via KMS | Via KMS | Via KMS | ✓ |
| Zero-knowledge architecture | ✗ | ✗ | ✗ | ✗ | ✓ |
| Self-service key rotation | Via KMS | Via KMS | Via KMS | Via KMS | ✓ |
| AES-256 encryption on disk | ✓ | ✓ | ✓ | ✓ | ✓ |
| A separate key per app | ✗ | ✗ | ✗ | ✗ | ✓ |
| Encryption while data moves | ✓ | ✓ | ✓ | ✓ | ✓ |
| Self-hosted on owned servers | ✓ | ✓ | ✓ | ✗ | ✓ |
Sources(21)
- Thales, "2025 Cloud Security Study," conducted by S&P Global 451 Research, 2025. "Only 8% of organizations encrypt 80% or more of their cloud data." "57% use five or more encryption key managers."
- IBM Security, "Cost of a Data Breach Report 2024," July 2024. "The global average cost of a data breach reached $4.88 million in 2024."
- Veeam supports external KMS integration for encryption key management including AWS KMS and Azure Key Vault.
- Rubrik supports customer-managed encryption keys via external KMS integration including KMIP-compatible servers.
- Commvault integrates with AWS KMS, Azure Key Vault, HashiCorp Vault, and KMIP-compatible key management servers.
- Druva Enterprise Key Management (BYOK) lets customers use their own AWS KMS keys to encrypt backup data.
- Veeam supports encryption key rotation through KMS integration for compliance with security policies.
- Rubrik supports encryption key rotation through its KMS integration for enterprise key management.
- Commvault supports automated encryption key rotation via the Rotate Encryption Master Keys workflow with configurable intervals.
- Druva supports both cloud encryption key and customer-managed AWS KMS key rotation for security compliance.
- Veeam encrypts backup data at rest using AES-256 encryption with hardware acceleration support.
- Rubrik encrypts all data at rest using AES-256 encryption with software or hardware-based key management.
- Commvault supports AES-256 encryption at rest with hardware-accelerated AES-NI support for backup data.
- Druva encrypts all data at rest with AES-256 using unique per-customer Data Encryption Keys.
- Veeam encrypts all data in transit using TLS for network traffic between backup components.
- Rubrik encrypts all data in transit using TLS 1.2+ between cluster nodes and remote targets.
- Commvault encrypts network traffic in transit using mutual TLS 1.3 with AES_256_GCM_SHA384 cipher suite.
- Druva encrypts all data in transit with TLS 1.2 (256-bit) between customer environment and Druva Cloud.
- Veeam Backup & Replication is deployed on-premises on Windows Server with full customer control over infrastructure.
- Rubrik is deployed as on-premises appliances (r6000 series) with integrated compute, storage, and software.
- Commvault supports fully self-hosted on-premises deployments with CommServe, MediaAgent, and Access Node components.
Explore Other Solutions
Own the encryption keys
Generate the first key in under a minute. Start the 14-day free trial.
Start free trial