Backup ransomware can't erase: end-to-end WORM immutability certified on Omid Cloud

A backup that can be deleted is a hostage waiting for a ransom note. Modern ransomware hunts your backups first — and if it can erase or encrypt them, the recovery plan dies with them. The only real defense is immutability: a backup that not even the administrator can delete or overwrite until its retention lapses.

We just certified exactly that. NGBackup's S3 object-storage driver passed a full certification against Omid Cloud object storage — 13 of 13 tests, run with the shipping driver binary speaking the real Storage-Daemon protocol, not a throwaway test client.

What we tested

• Full verb conformance — handshake, PUT, GET, HEAD, LIST-by-prefix, DELETE, and correct "absent" semantics for missing keys and post-delete reads.
• Byte-exact integrity — an 8 MiB object round-tripped and its SHA-256 matched the source exactly. What you back up is what you restore.

The test that matters: WORM immutability

The certification bucket was provisioned with Object Lock enabled. NGBackup wrote an object with its native object_lock = compliance setting and a retention window, and the storage registered it in COMPLIANCE mode with a hard retain-until date. Then we did what an attacker would do:

• Delete the locked version → the storage refused: InvalidRequest — Object is WORM protected and cannot be overwritten.
• Overwrite it → refused too; the original bytes stayed intact and SHA-256-verifiable.

That is end-to-end immutability: NGBackup asks for it per job, and the Omid backend enforces it — deletion and overwrite are physically blocked until retention expires. Ransomware that reaches this bucket finds a wall.

Immutable without the hidden cost

Object Lock requires bucket versioning (it's inseparable in the S3 spec), and unmanaged versioning quietly piles up noncurrent versions and delete markers on every volume recycle — storage growth your backup software never shows you. The certification closed that trap: a lifecycle policy expires noncurrent versions after their lock lapses and sweeps orphan delete markers, so locked backups stay untouchable while dead versions don't bloat your bill.

Why native beats a generic S3 gateway

Plenty of backup tools bolt on a generic S3 target and claim immutability they never tested against a real locked bucket. NGBackup's driver sets retention per job and was certified refusing what the backend refuses — a promise proven against the storage, not a checkbox in a config file. Immutability you can only hope works is worse than none, because it fails silently, during an incident.

Why immutable backups on Omid Cloud

Omid Cloud is a 100% Brazilian sovereign public cloud — its own Tier III data centers in Brazil (São Paulo and Rio de Janeiro), full-stack operation from the physical layer up, and a provider under Brazilian jurisdiction only. For an immutable backup target that pairs matters:

• Data sovereignty end to end — your backups physically in Brazil, with the cloud's orchestration in-country too, under LGPD and Brazilian law, not a foreign hyperscaler's terms.
• Predictable, fixed cost — a flat contracted price with zero egress fees. Backup and, above all, restore move a lot of data; on metered clouds a large recovery can produce a surprise bill exactly when you're already in an incident. Fixed cost removes that.
• National support — Omid controls every layer from data center to platform, so support is local and accountable.

Immutable storage where a restore won't cost you a metered fortune, on infrastructure that answers to Brazilian law — that's the pairing this certification unlocks.

The S3 driver ships in the free NGBackup Community

You don't need a paid tier to use any of this. The S3 cloud driver is included in NGBackup Community — the free-forever edition — alongside the full engine and plugins. Community backs up to 10 TB across 10 backup objects at no cost and no time limit; the exact same driver, with the same per-job Object Lock, that we certified here.

Download NGBackup Community free — the S3 driver is in the box. Point it at an Object-Lock bucket on Omid Cloud, run a backup, then try to delete it. Or book a POC for larger fleets.

Certification: NGBackup S3 Cloud Driver v2.1.6 against Omid Cloud object storage, 13/13 tests, July 2026. Immutability enforced in COMPLIANCE mode by the storage backend. Omid Cloud facts from omid.com.br and public reporting (DatacenterDynamics, TI Inside).