Architecture, deployment options, verification, and operational controls for long-term data integrity.
Overview
DATASTOR Shield™ implements hybrid cloud backup using patented source-side global deduplication, customer-controlled AES-256 encryption, and multi-level verification. The design supports the 3-2-1 rule (three copies, two media types, one off-site) with a local copy for LAN-speed recovery and an off-site copy for site-level resilience.
Two primary deployment models are available: software with optional paid cloud storage, or Hybrid Cloud / Co-Managed service using customer-supplied certified hardware.
Core Architecture
- Source-side global deduplication: redundant data is identified and removed on the protected system before transmission. Typical results are up to 20× storage reduction and roughly 10× shorter backup windows.
- Local target (disk, NAS/DAS) provides LAN-speed restore.
- Off-site target (cloud storage add-on, tape, or removable media) provides isolation from site-level events.
- Customer-controlled AES-256 encryption is applied before data leaves the environment. A secondary protection layer secures the key itself. The customer retains sole ownership of the keys.
Deployment Options
Software with Optional Cloud Storage Add-On
Install DATASTOR Shield™ on existing Windows infrastructure. Cloud storage is available as a paid add-on. Encryption keys and retention policies remain under customer control. No long-term contract is required.
Hybrid Cloud / Co-Managed Service (Bring Your Own Certified Hardware)
Pair DATASTOR Shield™ software with customer-supplied certified hardware, cloud storage, and co-managed monitoring. Daily checkup reports and recovery assistance are included. Service may be canceled with 30-day notice after the initial period.
Verification and Integrity
Three levels of continuous verification examine referential and data integrity. Objects that fail checks are quarantined and queued for self-healing. Daily checkup reports list completed jobs and highlight any expected jobs that did not run.
Operational Hardening
Recommended controls for the backup environment:
- Dedicated service account used only for protection plans and store tasks.
- NTFS (and share) permission lockdown so only the dedicated account has write access to the backup store. Limit or remove write permission for other accounts, including Administrators.
- No interactive logon with the backup service account.
- Optional: BitLocker on backup volumes and air-gapping via cartridge rotation on removable media.
Implementation Checklist
- Define RTO and RPO for critical systems.
- Select local and off-site targets.
- Enable customer-managed AES-256 encryption.
- Set retention longer than expected ransomware dwell time.
- Apply dedicated service account and NTFS lockdown.
- Enable verification and review daily checkup reports.
- Perform scheduled restore tests (file/application monthly or quarterly; full system at least annually).