Compliance
GDPR, data residency, SOC 2 readiness, PIPEDA, and regulatory compliance information.
Data Residency
BackupEngine allows you to choose where your backup data is stored at signup. Once selected, your data never leaves the chosen region. This is a hard architectural guarantee, not a policy-based control.
- •United States: Data stored in US-based iDrive e2 data centers.
- •Canada: Data stored in Canadian data centers. Meets PIPEDA and Canadian data sovereignty requirements.
- •European Union: Data stored in EU data centers. Designed to meet GDPR data residency requirements.
- •Your region choice is permanent for the lifetime of your account. Contact support if you need to migrate regions.
- •Metadata (file names, sizes, backup timestamps) is stored in Supabase, hosted in Canada.
ℹ Note
Even metadata stored in Supabase is protected by encryption in transit (TLS 1.3) and at rest. File names in metadata can optionally be encrypted with your encryption key if you enable the encrypted metadata option in Settings.
GDPR Compliance
BackupEngine is designed with GDPR compliance in mind for users in the European Union and the European Economic Area.
- •Data minimization: BackupEngine collects only the data necessary to provide the backup service (email, device info, backup metadata).
- •Right to erasure: The account owner can request deletion of the account and all associated backup data from the Customer Portal, or ask support to action the request. Deletion runs on a 30-day recovery window and is permanent once that window expires — see Account Deletion and Right to Erasure below.
- •Data portability: Users can export their backup data at any time using the restore functionality.
- •Consent: Clear consent is obtained during account creation. No pre-checked boxes.
- •Data Processing Agreement (DPA): Available upon request for business customers.
- •Sub-processors: A current list of sub-processors (Supabase, iDrive, Stripe) is maintained and available in the privacy policy.
Account Deletion and Right to Erasure
Deleting an account happens in two stages: a 30-day recovery window, then a permanent erasure. The account owner starts it from the Customer Portal under Settings → Danger Zone → Delete account. Team members cannot delete the account. You can also contact support to have the request actioned for you; we verify identity first and then run the same process.
- •Immediately: the account is locked and new backups are refused. Nothing is deleted at this stage. A self-serve request keeps the owner signed in so the deletion can be cancelled; a request actioned by support also signs out active sessions.
- •For the next 30 days: every database record and every encrypted chunk in object storage is retained. Restores stay available during the window — run them from the desktop agent — so you can retrieve your data before it is erased.
- •While locked you can still sign in, but most of the portal is disabled. Billing and invoices, plan selection, reports, usage reports, support and Settings stay available, so the account can be paid up and reinstated or the deletion cancelled. Devices, Sites, Files, Restore, Activity, Team, Requests and Download are locked.
- •At any point in those 30 days the account owner can cancel the deletion from the Customer Portal, or ask support to cancel it. The account returns to the status it held before the request, with every backup intact.
- •After 30 days: the erasure runs automatically. Every object stored for the account is deleted from iDrive e2, then the account itself is deleted, cascading every associated record. This stage is permanent and unrecoverable.
⚠ Warning
Deletion is reversible for 30 days and irreversible after that. If you need your data erased sooner, ask support to run the erasure immediately — that skips the recovery window entirely and cannot be undone.
PIPEDA Compliance
For Canadian users and organizations, BackupEngine is designed to comply with the Personal Information Protection and Electronic Documents Act (PIPEDA).
- •Canadian data residency option ensures backup data is stored within Canada.
- •Meaningful consent is obtained for all data collection and processing.
- •Users can access, correct, and delete their personal information at any time.
- •Data breach notification: BackupEngine will notify affected users and the Privacy Commissioner within 72 hours of discovering a qualifying breach.
- •Accountability: BackupEngine has designated a privacy officer responsible for PIPEDA compliance.
SOC 2 Readiness
BackupEngine is pursuing SOC 2 Type II certification. The following controls are already in place as part of our SOC 2 readiness program.
- •Access controls: Role-based access, mandatory MFA, principle of least privilege for all internal systems.
- •Encryption: AES-256-GCM client-side encryption, TLS 1.3 in transit, encryption at rest in storage.
- •Monitoring: Real-time security monitoring, intrusion detection, and automated alerting.
- •Audit logging: All administrative actions, data access, and configuration changes are logged with immutable audit trails.
- •Incident response: Documented incident response plan with defined escalation paths and communication procedures.
- •Vendor management: All sub-processors are evaluated for security posture and compliance.
💡 Tip
For enterprise customers requiring compliance documentation, contact our sales team for access to our security whitepaper, completed security questionnaires, and Data Processing Agreement templates.