Ransomware-Proof Backup: Why We Chose Kopia and Backblaze B2

A backup that a ransomware attacker can encrypt or delete is worthless. That was the single requirement that dictated the entire choice — and it led us to an unambiguous conclusion after we compared 11 open-source backup engines and four storage providers.

What the problem really is — "harvest then encrypt"

In a modern ransomware attack, the attacker gains privileges on the device and then does two things: encrypts the files, and deletes or encrypts the backups too so you can't restore. If your backup agent holds the storage keys, the attacker who took over the device holds them as well — and deletes the backup. So the first question isn't "how fast do you back up" but "can the backup be deleted at all."

What we compared — 11 open-source engines

We surveyed the entire landscape: restic, BorgBackup, Kopia, Duplicati, Duplicacy, rclone, UrBackup, Bareos, Proxmox Backup Server, ZFS, and Clonezilla. For each we checked: client-side dedup + encryption, Windows support (including VSS for open files), direct write to S3, and above all — real Object-Lock.

Why we chose Kopia

Kopia is the only engine today that does both client-side dedup + encryption and supports Object-Lock in Compliance mode against S3 storage. restic is excellent and popular, but its Object-Lock support hasn't been released yet. Borg is strong on Linux but has no real Windows support and no Object-Lock against S3. Duplicacy is disqualified on licensing (it may not be embedded in a commercial product). The technical verdict was clear.

On top of that: Kopia is a single binary (Go), runs on Windows (with VSS), Mac, and Linux — so we manage one engine across the entire fleet, with JSON output that's easy to orchestrate from the agent.

And why Backblaze B2 — and not Cloudflare R2

We already work on Cloudflare, so R2 was the obvious choice. But we dug deep and found: R2's "bucket locks" are not the S3 Object-Lock API, and they have no proven compliance guarantee that "a compromised key cannot delete." That doesn't meet our WORM bar.

B2 gives real WORM, the cheapest storage, and free egress via Cloudflare's CDN — so that restores are almost free. R2 stays with us for application data and a cheap secondary copy, but not for the immutable leg.

How we tested — we didn't rely on marketing

Every claim was verified against a primary source: each engine's official documentation, community discussions on Object-Lock, and licenses. Two critical findings we uncovered precisely through this reading: (1) restic is still not lock-free, and (2) Proxmox Backup may corrupt the datastore if you enable Object-Lock on it. Without this check we'd have chosen wrong.

Where we're honest: full restore to a virtual server

File engines (Kopia/restic) restore data, not a bootable machine. "Spin up the entire environment on a VM with one click" is exactly where Veeam/Datto/Proxmox beat open source. Our decision: build the files + immutable core on Kopia + B2 (where we win on price and sovereignty), and for full-server restore — integrate/resell a commercial engine rather than build from scratch. Honesty beats promises.

This article describes design considerations and technology choices. Prices and licensing capabilities are accurate as of mid-2026 and may change. There are no keys, secrets, or sensitive configuration details here.