When the music can’t stop: How Roskilde Festival uses Veeam to protect €65M in donations

Every summer, Roskilde Festival transforms the open farmland south of Roskilde, Denmark, into a fully digital city. For one week, 100,000 festivalgoers tap their wristbands to redeem vouchers or pay by credit card for food and beverages, scan them to pass through access gates, and connect with one another across the sprawling site. Behind the scenes, 30,000 volunteers coordinate shifts, logistics teams track supplies, and GIS systems map every stage and structure in real time.

The operation is completely cashless, too. If point-of-sale systems or critical backend services go down, there is no practical manual alternative. For Roskilde Festival Gruppen, recovery speed is directly connected to both festival operations and the success of its charitable mission.

"We are 100% cashless, and there is no practical way to keep the festival running if our point-of-sale clients or backend applications go offline. The operation would grind to a halt, and we’d lose a significant share of our festival revenue," said Steen Bechmann Henningsen, IT Security Manager at Roskilde Festival Gruppen.

These stakes go beyond revenue. Roskilde Festival Gruppen is a non-profit, and all profits from each year's festival must be donated before the next one comes around. Over the years, a total of €65 million has been donated. A week of downtime could directly reduce the funds available for charitable giving.

"With our incumbent solution we would not be able to restore important systems quickly enough for continuous operations without fallback to manual and slow procedures," said Henningsen.

Roskilde Festival also handles sensitive booking and production data relating to some of the world’s biggest artists. Protecting this information is essential to maintaining the trust and reputation the festival has built across the industry.

In additional, around 1,500 of the volunteers who work with Roskilde Festival year-round, access its systems from their own devices. With so many external devices connecting to its environment, the potential exposure increases, making data resilience mission-critical to the festival’s security, trust and continuity.

After weighing the growing risks of potential data compromise and downtime, Roskilde Festival Gruppen set out to strengthen its entire data protection and recovery posture. That search brought the team to Veeam. At a security event, Veeam’s focus on immutable storage and automated recovery verification convinced Roskilde that it was the right fit.

“Veeam’s position as the market leader in the data resilience industry was the ultimate selling point,” said Henningsen. “In addition, Veeam’s willingness to discuss special conditions given the organisation’s non-profit status reinforced the decision.”

Roskilde chose Veeam Data Platform as the foundation of its new approach and strengthened it with Veeam Data Cloud Vault, a fully managed, immutable, and physically isolated home for its backup data.

Working with local partner Comm2IG, the IT team deployed Veeam Data Platform in two phases. With the festival fast approaching, there wasn’t time to bring everything on board at once, so the team protected festival-critical systems first and added less critical workloads afterward. First-priority systems included volunteer and partner management platforms, the GIS system used for site architecture and planning, Active Directory servers, and SQL databases that underpin many of Roskilde’s applications. The environment spans both VMware in a private cloud and Hyper-V on-premises, including cluster and stand-alone hosts.

Veeam Data Cloud Vault keeps a copy of all backup data completely separate from Roskilde’s own infrastructure. Even if attackers breach the main environment, they can’t reach or change that copy.

"The idea of having an immutable copy of backup data in 100% isolated storage, I saw as mandatory," said Henningsen. Approximately 10 TB of festival-critical data is now fully protected.

Next, Roskilde is rolling out SureBackup to automatically verify that recovery points are clean and usable. That gives the IT team confidence its restores will work before the festival gates open. Over the coming months, the team plans to keep testing restores and refining its runbooks so it’s ready for anything.

"We've moved from hoping our backups work to proving they do — automatically, every week,” said Henningsen. “SureBackup will validate our recovery points; quarterly drills prove they're clean; updated runbooks ensure we execute flawlessly. For a non-profit, that continuous proof of resilience isn't just IT best practice — it's governance. It's how we protect the €65M mission our board members oversee.”

• One view across all workloads
  Where Roskilde once relied on an unstructured collection of tools and exports, Veeam Data Platform now delivers a single, consolidated view into their environment. Daily reporting covers every protected workload, giving Henningsen and his team immediate visibility into backup health across the entire environment.
• 10 TB of critical data, isolated and immutable
  Veeam Data Cloud Vault now protects all of its festival-critical data, including volunteer and partner management, site planning, Active Directory, and SQL databases. Because those backups are immutable and kept separate from Roskilde’s infrastructure, recovery copies remain protected even if attackers breach its primary systems.
• Data resilience confidence from IT to the boardroom
  The new approach has earned positive feedback from Roskilde’s Board of Directors, bringing data resilience into the boardroom instead of leaving it with IT alone. For a non-profit that depends on one week of revenue, that visibility matters. Roskilde now has greater confidence that its critical data is protected and that it can recover when it counts.