UK’s trusted IT infrastructure partner since 2003
sales@servnetuk.com
0800 987 4111
Servnet
FinanceToolsConfiguratorGet in Touch
Object Lock compliance mode · Zero Access · third-party tested

Veeam immutable backup on Ootbi
What the lock stops, and what it cannot

Many immutable targets leave someone a way to remove the lock, such as a governance-mode bypass permission or an administrator account on the server underneath. Object First's stated design is that nobody has one: compliance-mode Object Lock on a vendor-hardened operating system with SSH off by default. Here is how that works, what independent testers checked, and the gaps every immutable copy still has.
Compliance[src]
ONLY OBJECT LOCK MODE
On write[src]
TIME TO IMMUTABILITY
Zero Access[src]
TO DESTRUCTIVE ACTIONS
Annual[src]
NCC GROUP PENETRATION TEST
17a-4(f)[src]
COHASSET ASSESSMENT
15 chars[src]
MINIMUM PASSWORD
Overview

How Veeam immutable backup is enforced on Ootbi

Veeam immutable backup on Ootbi is enforced by the storage, not the backup software: Object First applies S3 Object Lock on the appliance, so backup data is immutable the moment it is written, with no administrative override[src].

Object First names three principles behind what it calls Absolute Immutability: a fully documented open standard with native immutability that can be tested independently (S3 Object Lock), data that is immutable the moment it is written, and a dedicated target appliance that keeps storage segmented from the backup software[src]. On top, its Trust Center lists Zero Access to destructive actions against the firmware, the OS, the storage application or the backup data, along with automatic firmware and OS updates, continuous verification of expected configuration and a lockout after repeated failed logins[src]. One sanctioned path to clearing a node is documented: a node-data reset that requires an 8-eyes validation procedure[src]. Its scope against unexpired locks is not described, so confirm it with Object First if your policy depends on it.

Layers protecting a backup on OotbiSign-in and network layers stop people getting in; the inner layers decide what they can do once inside.From the network edge to the locked objectWHAT PROTECTS ITWHO CAN UNDO ITNetwork edgeNo public IPs on iDRAC or nodesiDRAC restricted or unpluggedYour network teamObject First hardening guideSign-inMFA and 15-character passwordsLockout after repeated failuresAppliance adminsholding an MFA deviceAccess pathVeeam reaches it over S3/HTTPS onlySSH disabled after setupAppliance admins can enable SSHHardening guide: keep it offBucket settingsImmutability set when bucket is madeCannot be switched off afterwardsNobody, for that bucketObject LockCompliance mode on each versionCan be extended, never shortenedNobody before the lock dateObject First: no admin overrideSign-in and network layers stop people getting in; the inner layers decide what they can do once inside.
The controls between an attacker and a locked restore point, from the outside in. Network, sign-in and SSH settings are yours to keep, following Object First's hardening guide; the bucket and lock settings are fixed once made. Sources: Object First Trust Center, Help Center and release notes.
The lock

Compliance mode against governance mode

S3 Object Lock has two retention modes, and the difference is whether anyone can override them. Ootbi currently offers compliance mode only[src].

Amazon, which defined the standard, puts it plainly: in compliance mode a protected object version cannot be overwritten or deleted by any user, including the root user; its mode cannot be changed and its retention cannot be shortened. In governance mode, users with a special bypass permission can alter the retention or delete the object[src]. Object First's Help Center says governance mode will be added to Ootbi in a future release[src].

S3 Object Lock governance and compliance modesGovernance mode trusts whoever holds the bypass permission. Compliance mode trusts nobody.Governance modeCompliance modeBlocks most users from deleting✓✓Retention can be extended✓✓Bypass permission can delete early✓—Root user can delete earlyWith bypass—Retention can be shortenedWith bypass—Mode can be changed once setWith bypass—Available on Ootbi todayFuture release✓Governance mode trusts whoever holds the bypass permission. Compliance mode trusts nobody.
Mode definitions from the Amazon S3 Object Lock documentation; the last row from Object First's Help Center. Any user allowed to set retention can extend it in either mode, which is how Veeam keeps reused blocks locked.
Under attack

What someone holding your Veeam admin can and cannot do

Veeam's Zero Trust guidance assumes any network or connection could be compromised[src], and that includes the backup server. The test of the storage is what happens next.
An attacker with Veeam admin rights against an Ootbi targetA delete or overwrite can add a delete marker or new version; the locked version stays until its retention ends.ATTACKER HOLDSVeeam server adminAn Ootbi S3 accesskeyTRIES TODelete restorepointsShorten theretentionOverwrite backupfilesReset the nodeOOTBI ANSWERSRefused until thelock datelocked versions stayRefusedlocks only extendNew version writtenlocked version keptNeeds 8-eyesvalidationnode-data resetSTILL POSSIBLEStop or change newbackupsWait out the lockRead dataso encrypt in VeeamA delete or overwrite can add a delete marker or new version; the locked version stays until its retention ends.
Ootbi's responses from the AWS definition of compliance mode, Object First's Help Center and release notes. The last column is the honest part: no immutable target prevents these, so they are covered by the immutability period, encryption, detection and a second copy.

The middle column is the point of buying Ootbi, and it only applies to buckets created with versioning and immutability on[src], so check that every Veeam repository points at one. The right-hand column is why it is one layer, not the whole plan. Veeam's own ZTDR guidance says immutability does not protect confidentiality, which is what encryption is for, and that copies belong in more than one resilience zone[src]. Zero Trust Data Resilience explained →

The window

How long a restore point stays locked

An immutable copy is only safe for as long as it is locked. With Veeam on S3-compatible storage, that is at least the immutability period you set, and up to 10 days longer because of the block generation Veeam uses to cut down on lock-extension requests[src].
How long a restore point stays locked on OotbiPlan against the immutability period itself, and make it longer than you would take to notice an intruder.Days after the restore point is writtenJob retentionLocked (immutable)Block generation added by Veeam01020304050607080901007-day immutabilityVeeam’s worked exampleDeletable from day 1714-day immutabilityTwo weeks of protectionDeletable from day 2430-day immutabilityA common choiceDeletable from day 4090-day immutabilityFor slow-burn intrusionsDeletable from day 100Plan against the immutability period itself, and make it longer than you would take to notice an intruder.
Lock length for the restore point that starts a block generation, on a repository set to the minimum immutability period only (job retention ignored): the immutability period plus 10 days, per Veeam's v13 documentation for S3-compatible repositories. Incrementals written later in the same generation share its expiry, so each is locked for at least the immutability period; blocks reused by newer restore points stay locked longer.

Longer locks cost capacity, because nothing can be cleared early. That trade-off is the core of sizing immutable storage. How to size it →

Evidence

Independent testing and compliance claims

Object First publishes third-party evidence for its security claims. Each item below is Object First's claim about a third party's work, linked from its Trust Center[src].
Penetration testing

NCC Group, annually

Object First says an annual third-party penetration test by NCC Group covers the external attack surface, configuration hardening and resilience controls[src]. Object First also says third-party penetration testing found its Honeypot adds no risk to the cluster[src].
Secure by Design

CISA pledge

Object First has signed CISA's Secure by Design pledge and describes the appliance as Secure by Design as CISA defines it[src][src].
Financial records

Cohasset Associates report

Object First says Cohasset found Ootbi with Veeam can help meet SEC 17a-4(f), SEC 18a-6(e) and FINRA 4511(c)[src]. Amazon cites a Cohasset assessment for S3 Object Lock too[src].
Regulation

NIS2, DORA and the UK CSR Bill

Object First says Ootbi aligns with NIS2, DORA and the intent of the UK Cyber Security and Resilience Bill[src]. Alignment claims are not certifications. What the rules actually require →
Doing your part

The hardening Object First leaves to you

Object First's Help Center says its security page is not a complete guide and should be reviewed with your security provider[src]. These are the items it lists.
Network

Nothing on a public IP

No public addresses for IPMI or iDRAC, the text console, the cluster or the nodes, and iDRAC disabled or network-restricted[src].
Identity

MFA, and guard the recovery codes

Set up multi-factor authentication, keep recovery codes somewhere secure, regenerate them regularly and review who holds the authenticator[src].
Credentials

Change the factory passwords

Use a strong appliance password, change the factory iDRAC password and rotate cluster passwords regularly[src].
Physical

A locked, supervised room

Restrict physical access, keep appliances in a ventilated, locked room and supervise maintenance visits[src].
Supply & quote

Get immutable Veeam storage designed and quoted

  • We set the immutability period against how quickly you would detect an intrusion, then size capacity for it.
  • We plan the second copy, offsite or offline, so Ootbi is not the only line of defence.
  • We check Veeam encryption and key handling as part of the design.
  • We quote Ootbi appliances and Object First support together.

Get an Ootbi quote

Tell us how much Veeam protects and how long backups must stay locked. We size the appliance or cluster and quote it.

Business enquiries only — please use your company email. Gmail, Hotmail and other personal addresses are not accepted.

We only ship hardware to the countries in the dropdown. Software and maintenance services are global.

We use these details to reply to your enquiry and prepare any quote. No marketing emails without your consent. Privacy Policy

No obligation · response within 4 business hours

FAQs

Veeam immutable backup on Ootbi: common questions

What does Object First mean by Absolute Immutability?

Object First uses the term for backup storage with Zero Access to destructive actions against the firmware, the OS, the storage application or the backup data, so that nobody, including a privileged administrator, can alter or delete backups during their retention period. It rests on three things it lists: S3 Object Lock, an open, documented standard; data that is immutable the moment it is written; and a dedicated appliance segmented from the backup software.

Can an administrator delete Veeam backups on Ootbi?

Not through S3 while they are locked. Ootbi currently runs S3 Object Lock in compliance mode only, and in compliance mode no user, including the root account, can delete a locked object version or shorten its retention. Object First also documents a node-data reset that needs an 8-eyes validation procedure; its release notes do not say how that interacts with unexpired locks, so it is worth confirming with Object First. Once the lock date passes, Veeam’s retention removes the data as normal.

Does Ootbi support governance mode?

Not today. Object First’s Help Center says Ootbi operates only in compliance mode, so the governance option is not available, and that governance mode will be introduced in a future release.

What can an attacker do with stolen Veeam credentials?

They cannot delete or shorten locked restore points. They can still stop new backups, change job settings, read backup objects if they also hold an S3 key, and wait for the oldest locks to expire. That is why the immutability period should be longer than the time it would take you to notice an intrusion, why Veeam encryption should be on, and why Object First built a Honeypot decoy into the appliance.

Is Ootbi suitable for SEC 17a-4 or FINRA record retention?

Object First publishes a Cohasset Associates report and says it confirms Ootbi with Veeam can help meet SEC Rule 17a-4(f), SEC Rule 18a-6(e) and FINRA Rule 4511(c) requirements for non-rewriteable, non-erasable storage. As with any compliance report, it is evidence for your own assessment, not a certification that your setup complies.

Is backup data encrypted on Ootbi?

Encryption is Veeam’s job. Object First describes Ootbi as engineered to ingest and secure Veeam data encrypted at Veeam’s default block size, so turn encryption on in the Veeam job and keep the key, ideally in a key management system, somewhere an attacker on the backup network cannot reach.

How is an Ootbi wiped at end of life?

Release 1.7.92 added a Secure erase data disks procedure in the text console. It sanitises the storage pool and cache disks, checks the result and produces a report, and it only runs after the data has already been removed: migrated to other nodes, deleted after its immutability expired, or cleared by a node-data reset that needs an 8-eyes validation procedure.

The Object First range

More Object First pages

Keep exploring

Related Servnet guides, tools and hardware

Sources

Every specification on this page comes from Object First's own datasheets, product pages and Help Center, and every statement about how Veeam behaves comes from Veeam's own documentation, listed below with their dates. Where Object First's web copy and a datasheet differ, we use the datasheet. Figures are confirmed against the current revision when we quote.

  1. Object First Trust Center · web page, read 30 Oct 2026
  2. Object First Help Center 1.7: S3 repository for Veeam Backup for Microsoft 365 · Help Center v1.7, read 30 Oct 2026
  3. Object First Help Center 1.7: Bucket concept overview · Help Center v1.7, read 30 Oct 2026
  4. Object First Help Center 1.7: Secure the system · Help Center v1.7, read 30 Oct 2026
  5. Object First Help Center 1.7: Release notes · latest entry 1.7.99.15600, 1 Sep 2026
  6. Amazon S3 User Guide: Locking objects with Object Lock · AWS documentation, read 30 Oct 2026
  7. Veeam Backup & Replication 13 User Guide: Block Generation · page updated 6 Feb 2026, build 13.1.2.57
  8. Veeam Backup & Replication 13 User Guide: How Immutability Works · page updated 18 Mar 2026, build 13.1.2.57
  9. Veeam blog: Understanding Zero Trust Data Resilience (ZTDR) · published 1 Mar 2024, updated 12 Jun 2026
  10. Object First Honeypot · web page, read 30 Oct 2026
  11. Object First product overview · web page, read 30 Oct 2026
  12. Object First Appliance datasheet (1.1_20260116) · PDF dated 13 Mar 2026
  13. Pre-Requisites Checklist to Achieve Box-to-Backup in 15 Minutes · PDF dated 28 Dec 2023

Object First, Ootbi and Simply Resilient are trademarks of Object First; Veeam is a trademark of Veeam Software, which acquired Object First in January 2026. Servnet is an independent UK IT reseller; this page is our own guide to the range.

Talk to a UK specialist

Get expert advice or a no-obligation quote — servers, storage, networking, maintenance, finance and cloud. We reply the same working day.

or call 0800 987 4111