NGBackup protects everything from the mainframe to Microsoft 365 — 20+ commercial plugins, real-time ransomware defense, instant recovery and cross-hypervisor restore. Built entirely in Rust.
Per-socket, per-TB, per-workload, per-feature — licensing friction that balloons at renewal.
Restore is the universal weak point: bureaucratic flows, no point-in-time, error-prone.
Unstable C/C++ ABIs and monolithic agents — hard to QA, painful to install.
Proprietary formats trap your data and your budget. Migration means rip-and-replace.
Veeam · Commvault · NetBackup all share these gaps — and none are written in a memory-safe language.
NGBackup is a commercial, enterprise-grade backup, restore and replication platform, built as an all-new codebase written 100% in Rust. Four coordinated daemons, a PostgreSQL catalog, and a modern Web Console. The next slide covers what sets it apart.
A migration tool imports an existing Bacula catalog, volumes and configuration, so you move over at your own pace. Mixed deployments during the transition.
Six things legacy backup can't match.
An all-new codebase with zero lines of C. Memory-safe by construction, so memory-corruption CVEs cannot occur.
Reconfigure, reload and restart every daemon (Director, SD, FD) remotely from one place, with validation and rollback.
Director configuration lives in the database as immutable, versioned revisions. No config-file sprawl.
Token-based enrollment. Secrets are sealed, never written in plaintext to a config file.
High availability with catalog and configuration replication, automatic failover and split-brain guard.
Every plugin is compiled Rust, not PowerShell, Python or shell scripts. Faster, uniform, no interpreter surprises.
Director — orchestrates jobs, scheduling, catalog and console commands. Runs end-to-end in Rust.
Storage daemon — writes volumes, manages pools and device I/O with lock-free volume management.
Operator console — full CRAM-MD5 + TLS-from-start handshake; interactive restore file-tree.
File daemon — production Rust, loads 20+ signed plugins over a stable ABI.
tokio runtime with parallel digest / compress / encrypt stages and native backpressure.
sqlx-backed catalog (PG · MySQL · SQLite). Hash-partitioned, multi-timeline ready.
TLS 1.2+/1.3 enforced on every Director↔SD↔FD↔Console link, with mutual authentication.
Disk, tape and object storage: S3, OCI, Azure and GCS, with immutability. OCI storage certification in final stage; LinuxONE on the way.
Dashed = control channel · solid = data flow. Director, Storage & File daemons, catalog, consoles and every storage target.
Veeam is C#/.NET + C++. Commvault is Java + native libs. NetBackup is C++. All three regularly patch buffer-overflow and use-after-free vulnerabilities. NGBackup's Rust core eliminates that entire bug class by construction — while delivering multicore, zero-copy performance with no garbage-collector pauses.
Strong encryption in transit and at rest, with per-volume keys and optional per-job scope.
Mutual-auth encrypted channels on every link, via rustls — enforced, not optional.
Append-only volumes resist tampering and ransomware encryption. No cleartext hop: every data-plane link can run TLS-PSK end-to-end.
Resource-level access control with full audit routing to file, syslog, catalog and OpenTelemetry.
Plus Ed25519-signed manifests on plugins like MongoDB and File Replication — provable backup integrity.
A real-time agent watches the filesystem (inotify / ReadDirectoryChangesW) with four heuristics — burst rename, suspicious extensions, Shannon-entropy spikes and altered-ratio — then fires up to nine automated responses.
Every daemon — Director, Storage and File — is read, validated, reconfigured and restarted over a single authenticated console channel. No SSH, no co-located config files, no per-daemon login. The GUIs are thin clients: ACL-gated, TLS-encrypted, secret-redacted and fully audited.
Consoles never touch the catalog directly and never shell out to scattered binaries — every action is an ACL-checked, audited console verb with a SHA-256 fingerprint.
Every config write is validate → atomic write + backup → reload → auto-rollback on failure. Mutations are refused over plain TCP.
Daemons still boot from flat files by design — a catalog loss never makes the system un-startable. Structured management, zero bootstrap deadlock.
Inline, global dedup engine in Rust — FastCDC content-defined chunking + a multi-layer Bloom filter over a single shared namespace. Source-side mode chunks at the client and ships only new blocks; storage-side mode dedups at the SD. zstd / LZ4 per chunk.
A redb hot-path index replaces full filesystem walks — 3× faster on Linux, scaling ~20× on 600K-file corpora. Accurate mode skips unchanged files by size, mtime and optional checksum.
Boot a VM directly from storage-daemon bytes over NBD / iSCSI / NFS-datastore / SMB-VHDX — full + incremental chains folded automatically.
Descend into ext2/3/4 & NTFS guests; extract single files without a full disk restore.
Restore Proxmox / KVM / vSphere → Hyper-V and back — automatic qcow2 ↔ VHDX ↔ VMDK conversion. Live-validated on 5 platforms.
Every NGBackup feature is designed from the restore flow backward. PHGR delivers instant mount, granular extraction, point-in-time database recovery and true cross-hypervisor migration — the capabilities incumbents gate behind separate licenses.
No à-la-carte per-workload modules. From hypervisors to billion-file HPC filesystems, NGBackup covers the enterprise out of the box.
VADP + Changed Block Tracking, 10-mode DR failover/failback/reprotect, TLS replication, network re-IP.
Direct VHDX + RCT change tracking; RCT-push replication to DR (RPO minutes, RTO seconds), Gen1/Gen2 + UEFI preserved.
QEMU dirty-bitmap CBT, instant NBD-overlay boot, seed+bitmap-push replication, guest-consistent snapshots.
Prism CBT (v3/v4 CRT), iSCSI block streaming, alternate-cluster restore, replication to non-Nutanix targets.
3-layer CBT (QMP bitmap + xxHash64 + SIMD zero-detect), KVM direct restore (~10-min RTO), format conversion.
Cross-hypervisor V2V across all five — restore where you need to, hardware-independent DR, zero lock-in.
Data Pump + RMAN (SBT, no staging), TDE-transparent, Data Guard DR, PITR by SCN, ransomware canary.
Up to 64-way striped restore, instant recovery (queryable mid-restore), Always On AG aware, single-table restore.
WAL PITR (time/lsn/xid/name), PG17 incremental, VLDB COPY-range split, backup from standby.
xtrabackup LSN chains, single-table via transportable tablespaces, Galera/Group-Replication aware, CDP binlog.
5 modes incl. sharded + oplog PITR, collection/query granular restore, Ed25519-signed manifests.
Firebird, Informix (native XBSA), Progress OpenEdge, ADABAS — workloads Veeam simply doesn't cover.
Exchange, OneDrive, SharePoint, Teams + Chat via Graph delta APIs. Near-real-time CDC (RPO 60s), GDPR-forget audit trail. A 2.2 MB binary vs 100 MB+ JVM rivals.
Clientless across AD, OpenLDAP, 389DS, FreeIPA. 6 restore modes incl. authoritative, attribute, diff; RFC 4533 syncrepl + DirSync incrementals.
Live NSF backup with granular mailbox/document restore and NSF→EML export. Bacula Enterprise has zero Notes support — we're first.
Billion-file Lustre / GPFS / BeeGFS / CephFS / WekaFS with parallel walkers (10–100× metadata throughput), changelog-native incrementals, Slurm-aware.
Network gear, NAS and cloud SFTP — Cisco, Juniper, Fortinet, Synology, AWS Transfer — via SSH keys, no agent.
Real-time SD-side mirroring with BLAKE3 skip-unchanged, multi-site fan-out, AES-256-GCM at rest, RPO/RTO reporting.
| NGBackup | Veeam | Commvault | NetBackup | |
|---|---|---|---|---|
| Total cost | Low | High | Very high | Very high |
| All 20+ plugins included — no per-workload modules | ✓ | ✗ | ✗ | ✗ |
| Memory-safe + multicore (Rust) | ✓ | ✗ | ✗ | ✗ |
| Real-time ransomware response (Sentinel) | ✓ | ~ | ~ | ✗ |
| Restores never gated by license | ✓ | ✗ | ✗ | ✗ |
| Source-side global deduplication included | ✓ | ~ | ~ | ~ |
| 3× faster incrementals | ✓ | ✗ | ✗ | ✗ |
| Flexible licensing — per agent, per TB or MSP | ✓ | ✗ | ✗ | ✗ |
| Rare workloads (Informix · ADABAS · Notes · HPC) | ✓ | ✗ | ~ | ~ |
License however suits you — per agent, per TB, or an MSP/usage model. No per-feature upsell: every license already includes all plugins, global deduplication, ransomware defense and instant recovery.
Flexible licensing — per agent, per TB or MSP. Your choice.
Native NAS backup over the Network Data Management Protocol for enterprise filers.
First-class S3, AWS, Oracle Cloud, Google Cloud and Azure backup targets & sources.
Huawei virtualization (FusionCompute) protection — extending hypervisor coverage further.
BLAKE3-native dedup volumes with point-in-time, git-like restore.
Multi-site federation and opt-in high availability for the Director catalog.
1-click signed, sandboxed plugins installable without restarting the Director.
NGBackup's migration tool imports your existing Bacula catalog, volumes and configuration. Run mixed deployments, migrate at your pace, and cut your backup bill in half, while gaining ransomware defense, instant recovery and 20+ plugins none of the incumbents bundle.
Let's protect your infrastructure — and cut your backup budget in half. Start free, migrate at your pace.
An NGStructures brand · NGBackup · NGCompute