Veeam Takes Data Security Seriously to Ensure Your Data Is Protected
Industry Standards and Certifications
Veeam is continuously investing, innovating, and adding to industry and regulatory credentials to help ensure your data is protected and secure. Visit Veeam's Compliance Portal (login required) for a more in-depth look at our security and compliance controls, policies, and practices, along with evidence for your risk assessments and assurance activities.
 | SOC 2 Type 2 reviews an organization’s design of internal controls to assess compliance posture and determine whether the implemented controls meet the framework's requirements. Check out the Compliance Portal for more details.
Login required |
 | ISO, the International Organization for Standardization, brings global experts together to agree on the best way of doing things – for anything from making a product to managing a process. ISO provides globally recognized frameworks, including for information security, cybersecurity, quality management, and data protection. These frameworks help organizations build robust security programs that align with industry and legal requirements. Check out the Compliance Portal for more details.
Login required |
 | HIPAA / HITECH Type 2 Attestations are an independent third-party assessment that evaluates an organization’s compliance with HIPAA (Health Insurance Portability and Accountability Act) and HITECH (Health Information Technology for Economic and Clinical Health At) security, privacy, and breach notification requirements over a specific period. Check out the Compliance Portal for more details.
Login required |
 | Veeam Backup & Replication v12.1 has obtained the Department of Defense Information Network Approved Products List (DoDIN APL) certification. This prestigious certification validates Veeam's commitment to meet the most stringent security, interoperability and supportability requirements of the Department of Defense's (DoD) complex network environments.
|
 | Common Criteria (CC) is an international set of guidelines and specifications developed for evaluating information security products, specifically to ensure they meet an agreed-upon security standard for government deployments.
|
 | Veeam aligns its cybersecurity program with the NIST Cybersecurity Framework (CSF), contributed to the NIST Special Publication 1800-11 (Data Integrity: Recovering from Ransomware and Other Destructive Events) and meets FIPS 140-2 compliance.
|
 | FIPS 140-3 is a U.S. government standard that defines security requirements for cryptographic modules used to protect sensitive information. Validation under the Cryptographic Module Validation Program (CMVP) confirms that the module has been independently tested and meets strict standards for encryption, key management, and cryptographic operations.
|
 | The Federal Risk and Authorization Management Program (FedRAMP®) provides a standardized approach to security authorizations for Cloud Service Offerings for the United States Federal Government.
|
 | Iron Bank is the U.S. Department of Defense’s central repository for hardened, containerized software artifacts that meet stringent cybersecurity standards. Being included in the repository demonstrates that Veeam Kasten solutions meet U.S. federal and defense security requirements, supporting secure deployment in government environments.
|
 |
The Cloud Security Alliance (CSA) STAR Registry documents and validates the cloud security controls of service providers. Being included in the registry provides transparency and demonstrates Veeam’s commitment to industry-leading cloud security practices.
|
 |
Members of the Information Security Registered Assessors Program (IRAP) assess cloud services in compliance with Australian government cybersecurity standards. IRAP assessment enables Veeam to serve Australian government and public sector customers by meeting local regulatory requirements.
|
 | The Cybersecurity Maturity Model Certification (CMMC) v2 Level 1 establishes foundational cyber hygiene for U.S. Department of Defense (DoD) contractors. Certification allows Veeam to participate in U.S. Department of Defense contracts, ensuring protection of federal information.
Login required |
 |
Texas Risk and Authorization Management Program (Texas RAMP) certifies the security of cloud services used by Texas state agencies. Certification enables Veeam to provide compliant cloud solutions to Texas public sector organizations.
|
|
SOC 2 Type 2 reviews an organization’s design of internal controls to assess compliance posture and determine whether the implemented controls meet the framework's requirements. Check out the Compliance Portal for more details. Login required |
|
ISO, the International Organization for Standardization, brings global experts together to agree on the best way of doing things – for anything from making a product to managing a process. (ISO) provides globally recognized frameworks, including for information security, cybersecurity, quality management, and data protection. These frameworks help organizations build robust security programs that align with industry and legal requirements. Check out the Compliance Portal for more details. Login required |
|
HIPAA / HITECH Type 2 Attestations are an independent third-party assessment that evaluates an organization’s compliance with HIPAA (Health Insurance Portability and Accountability Act) and HITECH (Health Information Technology for Economic and Clinical Health At) security, privacy, and breach notification requirements over a specific period. Check out the Compliance Portal for more details. Login required |
|
Veeam Backup & Replication v12.1 has obtained the Department of Defense Information Network Approved Products List (DoDIN APL) certification. This prestigious certification validates Veeam's commitment to meet the most stringent security, interoperability and supportability requirements of the Department of Defense's (DoD) complex network environments. |
|
Common Criteria (CC) is an international set of guidelines and specifications developed for evaluating information security products, specifically to ensure they meet an agreed-upon security standard for government deployments. |
|
Veeam aligns its cybersecurity program with the NIST Cybersecurity Framework (CSF), contributed to the NIST Special Publication 1800-11 (Data Integrity: Recovering from Ransomware and Other Destructive Events) and meets FIPS 140-2 compliance. |
|
FIPS 140-3 is a U.S. government standard that defines security requirements for cryptographic modules used to protect sensitive information. Validation under the Cryptographic Module Validation Program (CMVP) confirms that the module has been independently tested and meets strict standards for encryption, key management, and cryptographic operations. |
|
The Federal Risk and Authorization Management Program (FedRAMP®) provides a standardized approach to security authorizations for Cloud Service Offerings for the United States Federal Government. |
| Iron Bank is the U.S. Department of Defense’s central repository for hardened, containerized software artifacts that meet stringent cybersecurity standards. Being included in the repository demonstrates that Veeam Kasten solutions meet U.S. federal and defense security requirements, supporting secure deployment in government environments. |
|
The Cloud Security Alliance (CSA) STAR Registry documents and validates the cloud security controls of service providers. Being included in the registry provides transparency and demonstrates Veeam’s commitment to industry-leading cloud security practices. |
|
Members of the Information Security Registered Assessors Program (IRAP) assess cloud services in compliance with Australian government cybersecurity standards. IRAP assessment enables Veeam to serve Australian government and public sector customers by meeting local regulatory requirements. |
| The Cybersecurity Maturity Model Certification (CMMC) Level 1 establishes foundational cyber hygiene for U.S. Department of Defense (DoD) contractors. Certification allows Veeam to participate in U.S. Department of Defense contracts, ensuring protection of federal information.
Login required |
|
Texas Risk and Authorization Management Program (Texas RAMP) certifies the security of cloud services used by Texas state agencies. Certification enables Veeam to provide compliant cloud solutions to Texas public sector organizations. |
Security & Risk Management
Veeam is endlessly integrating security and risk management into every step of our business – so you can trust your data stays protected, always. Visit Veeam's Compliance Portal (login required) for a more in-depth look at our security and compliance controls, policies, and practices, along with evidence for your risk assessments and assurance activities.
 | Products designed with Secure by Design principles prioritize the security of customers as a core business requirement, rather than merely treating it as a technical feature. Veeam has signed the Security by Design Pledge and affirmed our adherence to secure development practices.
RSAA login required |
|
Products designed with Secure by Design principles prioritize the security of customers as a core business requirement, rather than merely treating it as a technical feature. Veeam has signed the Security by Design Pledge and affirmed our adherence to secure development practices. RSAA login required |
Government Access Requests: Policies and FAQs
Veeam is committed to transparency and privacy. Explore how we manage government and law enforcement requests, from strict compliance procedures to customer notification policies and privacy protections under global standards.
 |
Responding to Government Request See Veeam’s official process for handling government and law enforcement data requests. Learn how we protect customer rights while maintaining full legal compliance and accountability.
|
 |
Government Access Requests FAQs Get clear answers about how Veeam manages government access requests, the safeguards we apply, and your rights as a customer. You’ll also find our annual transparency report detailing requests received and addressed in the past year.
|
|
Responding to Government Request See Veeam’s official process for handling government and law enforcement data requests. Learn how we protect customer rights while maintaining full legal compliance and accountability.
|
|
Government Access Requests FAQs Get clear answers about how Veeam manages government access requests, the safeguards we apply, and your rights as a customer. You’ll also find our annual transparency report detailing requests received and addressed in the past year.
|
Environmental, Social and Governance
At Veeam, we recognize the critical importance of environmental stewardship, social responsibility, and effective governance in creating sustainable value for our stakeholders, customers, and Veeamers.
 | Veeam's reporting aligns with key ESG frameworks and standards such as the Global Reporting Initiative (GRI), Sustainability Accounting Standards Board (SASB), and Task Force on Climate-related Financial Disclosures (TCFD).
|
|
Veeam's reporting aligns with key ESG frameworks and standards such as the Global Reporting Initiative (GRI), Sustainability Accounting Standards Board (SASB), and Task Force on Climate-related Financial Disclosures (TCFD). |
Veeam’s Commitment to Accessibility
Veeam partners with Level Access, a third-party service provider that helps make websites and digital tools easier for everyone to use, including people with disabilities. As a leader in digital accessibility, Level Access works with Veeam to check our websites and apps, fix problems, and teach our teams how to make these resources more accessible.
FAQs
How can I obtain more information about Veeam’s security compliance and/or certifications?
How does Veeam ensure compliance with data protection regulations?
Are there any specific certifications or accreditations that Veeam holds for data protection?
Veeam holds numerous certifications pertinent to data protection, including:
- ISO Certifications: 27001, 27017, 27018, 22301, and 27701
- Government Data Certifications: DoDIN APL, APL SOCOM, and FIPS 140-2
- Others: HIPAA / HITECH Type 2
For more information on Veeam’s certifications and accreditations, see Veeam's Compliance Portal (login required).
How can I report a security concern?
How does Veeam comply with DORA?
Veeam supports the requirements of DORA through a robust resilience framework that includes advanced monitoring, incident response, continuous service availability, and regular system testing.
We align with recognized standards such as ISO 27001 and SOC 2 to strengthen protection against cyber threats.
Customers in the scope of DORA may request to sign the financial sector addendum by contacting their Veeam Sales Representatives.
How does Veeam use AI responsibly in its products and services?
At Veeam, we embrace the responsible use of AI in our products, services, and operations. We are committed to ensuring responsible AI deployment, focused on fairness, reliability, transparency, and accountability. Veeam integrates AI-powered assistants (Veeam Intelligence) within several on-premises and cloud products. These assistants help users with technical support, product configuration, and troubleshooting.
Veeam adheres to responsible AI best practices, including transparency, security, privacy, and human oversight, aligning with the NIST AI Risk Management Framework and Microsoft Responsible AI principles.
What ethical principles guide Veeam’s AI development and deployment?
Veeam is committed to:
- Transparency: Informing users how AI systems work at Veeam including what data is used, how responses are generated, and what third-party services are used.
- Fairness & Non-discrimination: Utilizing AI models that are tested and monitored to minimize bias and avoid discriminatory outputs, where applicable.
- Security: Embedding industry-leading security for AI features by hosting AI models and systems in secure environments that include encryption, Role-Based Access Control, and secure communications.
- Privacy: Prohibiting user queries and customer backup data from being used to train generative AI models, without explicit consent.
- Veeam Responsible AI Training: Furthering our education of responsible AI use, including the completion of Responsible AI Training for all Veeam personnel involved in the development of AI capabilities, and following industry best-practices for AI usage.
How does Veeam ensure transparency in AI?
Responses from Veeam Intelligence are based on official Veeam documentation and Knowledge Base, with links provided for reference.
- Users are informed when AI is used and can see the sources behind recommendations.
- Veeam maintains a clear disclaimer about the limitations of generative AI and provides means for customers to verify the accuracy of the responses.
- Veeam encourages users to avoid unnecessarily sharing confidential information with AI assistants.
Does Veeam use customer-provided backup data to train large language models (LLMs)?
How does Veeam monitor and improve its AI?
Can users opt out of or disable Veeam Intelligence?
What are the limitations and disclaimers for using Veeam Intelligence?
AI responses may not always be accurate; users should verify any recommendations before acting.
Veeam leverages third party services to answer customer queries. Use of Veeam Intelligence does not require the user to input personal data and Veeam advises users to not input any personal information unless relevant.
What Generative AI Models Power Veeam Intelligence?
Does Veeam use any other third-party AI services?
How does Veeam ensure the privacy and security of data sent to third-party AI service providers?
How does Veeam comply with the EU AI Act and other AI laws?
Veeam ensures compliance with AI regulatory frameworks, such as the EU AI Act, by prioritizing ethical AI practices and governance. We have established an internal responsible AI policy and an AI use governance process to assess and mitigate risks associated with AI deployment, including evaluating our use of AI systems against high-risk AI criteria outlined in the EU AI Act.
Veeam’s AI services do not rise to the level of a “Prohibited AI Activity” or “High Risk” under the EU AI Act. Our AI services are not intended to be used as a safety component of a product, nor are they covered by the EU’s harmonization legislation listed in Annex I or Annex III of the EU AI Act. As such, Veeam has Transparency obligations under Chapter IV, Article 50 of the EU AI Act. These obligations include notifying users when they are interacting with AI systems and providing clear instructions on the appropriate and intended use of AI systems.
What data does Veeam process for on-premises (Veeam Data Platform (VDP)) and SaaS (Veeam Data Cloud (VDC)) products?
- VDP and other on-premises products: Veeam does not access your backup data and may process some personal data included in product log files once you explicitly share it with Veeam for maintenance and support. You can scrub logs of any personal and sensitive data before sharing with Veeam.
- VDC: Veeam processes data you store in a selected storage region offered by the selected storage provider (such as Azure or AWS); logs and backups are encrypted and stored securely.
Are my VDC backups encrypted?
How does Veeam protect privacy during support?
Does Veeam sign Data Processing Addendums (DPAs)?
For VDP and other on-premises products, since Veeam does not have access to your backups and therefore does not systematically process any personal data, a DPA is not required.
For VDC , a DPA is incorporated by reference into the VDC Service Agreement, which each customer reviews and agrees to during deployment.
Who are Veeam’s sub-processors for VDC?
How can I exercise my data subject rights (e.g., access, correction, erasure) with Veeam?
What is Veeam’s data retention and deletion policy?
What privacy-related certifications and compliance programs does Veeam participate in?
How does Veeam legalize transfers of customer personal data outside of the European Economic Area (EEA), Switzerland, and the UK?
Can Veeam access customer data?
Does Veeam sell or share customer backup data with third parties?
How can I learn more or raise a privacy concern?
Where Data & AI Trust
Converge
for the Agentic Era
Request Custom Demo
Oops! Something went wrong.
Please, try again later.