Ransomware recovery

Assume they get in.
Recover anyway.

Attackers go after backups first. Plakar keeps encrypted, tamper-evident snapshots they cannot read or silently alter, plus an off-site copy at another provider, so your disaster recovery plan holds when it matters.

The problem

Ransomware goes after your backups first.

If an attacker can read, encrypt, or delete your backups, you do not have a recovery plan. You have a negotiation.

Backups in the same blast radius

Backups reachable with the same credentials as production fall with production. One compromised admin account is enough to wipe both.

Readable backups are a second breach

Unencrypted backups hand attackers a full copy of your data to exfiltrate and leak, even after you have restored.

Restores nobody has tested

Backups that were never verified or restored fail in the middle of the incident, when it is too late to fix them.

How it works

Encrypt, verify, isolate, recover.

Four layers between the attacker and your last good snapshot.

  1. 01

    Encrypt at the source

    Data is chunked, deduplicated and encrypted before it leaves your environment. Storage only ever holds ciphertext, and passphrases live in your Control Plane or your own secret manager.

  2. 02

    Detect any tampering

    Every snapshot is signed and every chunk carries a MAC, so any change is detected. A check task can run after each backup to prove the Kloset is intact.

  3. 03

    Keep a copy out of reach

    Sync snapshots to an off-site Kloset on another provider, account or storage tier, or export a self-contained, encrypted .ptar archive to keep offline.

  4. 04

    Restore what you need

    Browse any snapshot, download a single file, or restore a whole resource to its original location or an isolated one, so you can rehearse recovery without touching production.

Truly immutable? Plakar snapshots are never modified in place, and any change is detected. For immutability enforced by the storage itself, pair them with object lock, WORM, or an offline .ptar copy.

What you get

Built for the worst day, not the average one.

Audited encryption

End-to-end encryption whose cryptography was reviewed in an independent audit.

Learn more

Tamper-evident snapshots

Signed snapshots and MACs, verified by check tasks after every backup.

Learn more

Second copy with sync

Replicate a Kloset to another store, provider, or tier on a schedule.

Learn more

Offline .ptar archives

One encrypted, read-only file to store offline.

Learn more

Legal hold

Freeze a restore point so no one can delete or prune it through the Control Plane. Pair it with your storage's object lock.

Learn more

Least privilege

Granular roles, enforced two-factor authentication, and Edges that open no inbound ports.

Learn more

Active Directory recovery

System State backups of your domain controllers, often the first thing to bring back.

Learn more

Granular restore

Browse, download single files, or restore to a new target.

Learn more

Get started

Recover on your terms, not theirs.

Start on the free plan, or walk through your recovery plan live with our team.

See how it fits together on the Control Plane page.