Backup Immuable
Anti-Ransomware
Immutable Anti-Ransomware
Backup
TrueNAS ZFS + Proxmox Backup Server deployed by Convergent. Tamper-proof snapshots, AES-256 encrypted off-site replication, guaranteed restoration after ransomware attack. Native 3-2-1-1 rule implementation.
target backups first
from ZFS snapshot
at rest + in transit
gold standard
Why immutable backup is essential
94% of modern ransomware attacks target backups first. A conventional backup encrypted by ransomware = inevitable ransom. An immutable backup = guaranteed restoration.
Tamper-proof ZFS snapshots
ZFS snapshots are atomic read-only. Even root cannot delete them during the retention period. Ransomware cannot encrypt or erase them — guaranteed restoration.
Encrypted off-site replication
AES-256 encrypted ZFS send/receive to secondary site (Tunis datacenter or private cloud). Automatic scheduling: hourly, daily, weekly. Configurable RPO.
Fast restoration <15 min
Granular restoration: single file, folder, full VM or disk snapshot. Proxmox Backup Server enables live restoration without service interruption.
3-2-1-1 Rule
3 copies · 2 different media · 1 off-site · 1 immutable. Convergent designs and deploys this complete architecture: primary TrueNAS + off-site replica + immutable snapshot.
Regulatory compliance
GDPR: guaranteed retention and deletion. PCI-DSS: logs and card data protected. ISO 27001 A.12.3: documented and tested backup plan. Compliance reports generated automatically.
Unified management
Modern TrueNAS SCALE interface. Native Proxmox Backup Server integration. Email/SMS alerts on failure. Automatic backup reports. Convergent support included.
Convergent reference architecture
Convergent deploys a complete end-to-end architecture, tested and documented.
Primary site — TrueNAS SCALE
NAS server with RAIDZ2 ZFS pool. Automatic snapshots hourly, daily (30d), weekly (12w). AES-256 at-rest encryption. Disk SMART monitoring.
VM Backup — Proxmox Backup Server
PBS integrated with Proxmox VE. Server-side deduplication and compression (60–80% space reduction). Automatic integrity verification. Fine-grained retention policy.
Secondary site — encrypted replication
Encrypted ZFS send/receive to off-site NAS or private cloud. Bandwidth-optimised via incremental send. Replication monitoring and failure alerts.
Frequently Asked Questions
What is an immutable backup?
An immutable backup is a backup whose data cannot be modified or deleted during a defined period (WORM — Write Once, Read Many). Even an administrator with root access cannot erase snapshots during their retention period. Ransomware cannot encrypt immutable backups.
Does TrueNAS ZFS really protect against ransomware?
Yes. ZFS creates atomic snapshots at defined intervals (hourly, daily). These snapshots are read-only and can only be deleted according to the retention policy. Even if the network is compromised and primary data encrypted, snapshots remain intact and allow full restoration in minutes.
What is the 3-2-1-1 rule?
3 copies of data, on 2 different media, including 1 off-site, including 1 immutable (air-gapped or WORM). This is the gold standard for data protection against ransomware, recommended by CISA, ANSSI and ENISA. Convergent deploys this complete architecture.
How long does restoration take after an attack?
With Proxmox Backup Server, restoring a full VM (100 GB) takes less than 15 minutes from the most recent snapshot. Granular restoration (single file) takes less than 2 minutes. RTO (Recovery Time Objective) is configurable according to your SLA.
Are you ready for the next ransomware?
94% of ransomware-targeted companies had no immutable backup. Convergent designs and deploys your 3-2-1-1 architecture in less than 10 days.