CrashPlan
CrashPlan is committed to the security of your data.
CrashPlan includes the strongest data encryption, both in transit and at rest. You control the encryption keys and where your data is stored.
Security at CrashPlan
Security is a foundational principle at CrashPlan, covering confidentiality, integrity and availability. At CrashPlan we take a comprehensive approach to securing our products and protecting your data. We imbed industry security standards in our processes which are verified and validated by independent auditors and third parties, giving our customers assurance that their data is secure. CrashPlan provides you with peace of mind, knowing that:
- Your data is encrypted both in transit and at rest.
- You maintain control over the encryption keys.
- CrashPlan maintains end-to-end control of the cloud stack, including software, storage and network hardware, and security components.
- CrashPlan performs rigorous quality testing of platform and product code and follows industry security best practices.
- CrashPlan leverages strong authentication protocols to ensure authorized customer access.
- CrashPlan conducts ongoing vulnerability testing by professional third parties and internal teams.
- CrashPlan personnel provide full-time monitoring of the CrashPlan cloud environment and maintains a dedicated response team.
- Crashplan conducts a comprehensive security awareness training program for all its personnel.
CrashPlan maintains compliance certifications and attestations on our product and infrastructure to validate our security program. Additionally, CrashPlan ensures and monitors appropriate security assurance obligations (SOC 1, SOC2, ISO27001) for our cloud data centers. Learn more about our compliance certifications and standards below.
*Other organizations, such as managed service providers and resellers, may provide cloud storage using CrashPlan cloud hardware and software. The information on this page may not apply to the cloud data centers managed by those organizations. Please contact those organizations for information about the features of their cloud solutions.
Data Privacy at CrashPlan
We are committed to the privacy and protection of our customers’ data.
Keeping your data secure and private is paramount to our success as a business. We follow global privacy principles to design practices and products that safeguard your data and enable your organization to meet its own privacy obligations.
Transparency
CrashPlan values trust and transparency.
Whether you are a prospective or existing customer, it’s important to us that we’re clear about our data practices.
The data protected by CrashPlan through our products is customer data that is owned and controlled by the customer. CrashPlan will only process that data in order to provide our services as described in our agreements and product documentation. In addition, CrashPlan processes and controls other information about potential and existing customers, including account-related information. For more details on how CrashPlan processes this data, please review our Privacy Statement.
CrashPlan does not and will not sell our customers’ data.
To provide our services, CrashPlan may engage and use sub-processors as part of our service offering. CrashPlan has a mature third-party security process to ensure your data remains secure and protected. We validate that sub-processors have the appropriate privacy and security safeguards and contractual agreements in place to protect your data.
View our Authorized Sub-processors.
Protecting your data
CrashPlan’s commitment to protecting customer data is built into our agreements. A Data Processing Addendum (“DPA”) is automatically incorporated into our Master Services Agreements. The DPA is based upon globally recognized privacy standards, including the GDPR, UK Data Protection Act, and CCPA.
CrashPlan supports international data transfers by executing standard contractual clauses through our updated DPA, which is available to all customers and can be viewed here.
We use industry security best practices that are regularly verified by external auditors. This includes end-to-end encryption of your files, customer-controlled access, and deletion of your files after your subscription ends.
Privacy in our product
- Access controls. CrashPlan provides a variety of role-based access and permissions controls within the product which allow manual or automated (via an external Identity Provider) access delegation.
- Audit logs. CrashPlan maintains both customer-facing and internal audit-logging to ensure proper monitoring of privileged accounts.
- Data encryption. CrashPlan leverages independently tested industry best practices and protocols to ensure that all data backed up to the service is encrypted both in transit and at rest.
- Retention and storage. CrashPlan allows you to control how and when back up operations take place, what files to include and exclude from back up, the frequency of back up, and how long file versions should be retained.
Compliance at CrashPlan
Compliance is built into everything we do.
There are a myriad of compliance requirements across industries and geographies that our customers have to comply with. Our platform helps you maintain your compliance with regulations governing where and how your data is stored, who can access it, and how it is protected.
With CrashPlan, you are in control and have peace of mind knowing that our platform provides:
- Layered data encryption.
- Customer controlled encryption keys.
- Role-based access control.
- Multi-Factor Authentication.
- Control over data residency.
- Simple enterprise-wide administration.
- Tamper-proof audit trails.
- Compliance with data export laws.
- Permanent data deletion after your subscription ends.
Data recovery and resiliency are key components of most security and privacy regulations. CrashPlan helps its customers meet their applicable compliance and risk management requirements while meeting their data resiliency needs.
