Security is a foundational principle at CrashPlan, covering confidentiality, integrity and availability. At CrashPlan we take a comprehensive approach to securing our products and protecting your data. We imbed industry security standards in our processes which are verified and validated by independent auditors and third parties, giving our customers assurance that their data is secure. CrashPlan provides you with peace of mind, knowing that:
- Your data is encrypted both in transit and at rest.
- You maintain control over the encryption keys.
- CrashPlan maintains end-to-end control of the cloud stack, including software, storage and network hardware, and security components.
- CrashPlan performs rigorous quality testing of platform and product code and follows industry security best practices.
- CrashPlan leverages strong authentication protocols to ensure authorized customer access.
- CrashPlan conducts ongoing vulnerability testing by professional third parties and internal teams.
- CrashPlan personnel provide full-time monitoring of the CrashPlan cloud environment and maintains a dedicated response team.
- Crashplan conducts a comprehensive security awareness training program for all its personnel.
CrashPlan maintains compliance certifications and attestations on our product and infrastructure to validate our security program. Additionally, CrashPlan ensures and monitors appropriate security assurance obligations (SOC 1, SOC2, ISO27001) for our cloud data centers. Learn more about our compliance certifications and standards below.
*Other organizations, such as managed service providers and resellers, may provide cloud storage using CrashPlan cloud hardware and software. The information on this page may not apply to the cloud data centers managed by those organizations. Please contact those organizations for information about the features of their cloud solutions.
We are committed to the privacy and protection of our customers’ data.
Keeping your data secure and private is paramount to our success as a business. We follow global privacy principles to design practices and products that safeguard your data and enable your organization to meet its own privacy obligations.
CrashPlan values trust and transparency.
Whether you are a prospective or existing customer, it’s important to us that we’re clear about our data practices.
The data protected by CrashPlan through our products is customer data that is owned and controlled by the customer. CrashPlan will only process that data in order to provide our services as described in our agreements and product documentation. In addition, CrashPlan processes and controls other information about potential and existing customers, including account-related information. For more details on how CrashPlan processes this data, please review our Privacy Statement.
CrashPlan does not and will not sell our customers’ data.
To provide our services, CrashPlan may engage and use sub-processors as part of our service offering. CrashPlan has a mature third-party security process to ensure your data remains secure and protected. We validate that sub-processors have the appropriate privacy and security safeguards and contractual agreements in place to protect your data.
View our Authorized Sub-processors.
CrashPlan’s commitment to protecting customer data is built into our agreements. A Data Processing Addendum (“DPA”) is automatically incorporated into our Master Services Agreements. The DPA is based upon globally recognized privacy standards, including the GDPR, UK Data Protection Act, and CCPA.
CrashPlan supports international data transfers by executing standard contractual clauses through our updated DPA, which is available to all customers and can be viewed here.
We use industry security best practices that are regularly verified by external auditors. This includes end-to-end encryption of your files, customer-controlled access, and deletion of your files after your subscription ends.
Compliance is built into everything we do.
There are a myriad of compliance requirements across industries and geographies that our customers have to comply with. Our platform helps you maintain your compliance with regulations governing where and how your data is stored, who can access it, and how it is protected.
With CrashPlan, you are in control and have peace of mind knowing that our platform provides:
- Layered data encryption.
- Customer controlled encryption keys.
- Role-based access control.
- Multi-Factor Authentication.
- Control over data residency.
- Simple enterprise-wide administration.
- Tamper-proof audit trails.
- Compliance with data export laws.
- Permanent data deletion after your subscription ends.
Data recovery and resiliency are key components of most security and privacy regulations. CrashPlan helps its customers meet their applicable compliance and risk management requirements while meeting their data resiliency needs.