NGBackup protects everything from the mainframe to Microsoft 365 — 20+ commercial plugins, real-time ransomware defense, instant recovery and cross-hypervisor restore. Built entirely in Rust.
Per-socket, per-TB, per-workload, per-feature — licensing friction that balloons at renewal.
Restore is the universal weak point: bureaucratic flows, no point-in-time, error-prone.
Unstable C/C++ ABIs and monolithic agents — hard to QA, painful to install.
Proprietary formats trap your data and your budget. Migration means rip-and-replace.
Veeam · Commvault · NetBackup all share these gaps — and none are written in a memory-safe language.
NGBackup is a commercial, enterprise-grade backup, restore and replication platform, built as an all-new codebase written 100% in Rust. Four coordinated daemons, a PostgreSQL catalog, and a modern Web Console. The next slide covers what sets it apart.
A migration tool imports an existing Bacula catalog, volumes and configuration, so you move over at your own pace. Mixed deployments during the transition.
Six things legacy backup can't match.
An all-new codebase with zero lines of C. Memory-safe by construction, so memory-corruption CVEs cannot occur.
Reconfigure, reload and restart every daemon (Director, SD, FD) remotely from one place, with validation and rollback.
Director configuration lives in the database as immutable, versioned revisions. No config-file sprawl.
Token-based enrollment. Secrets are sealed, never written in plaintext to a config file.
High availability with catalog and configuration replication, automatic failover and split-brain guard.
Every plugin is compiled Rust, not PowerShell, Python or shell scripts. Faster, uniform, no interpreter surprises.
Director — orchestrates jobs, scheduling, catalog and console commands. Runs end-to-end in Rust.
Storage daemon — writes volumes, manages pools and device I/O with lock-free volume management.
Operator console — full CRAM-MD5 + TLS-from-start handshake; interactive restore file-tree.
File daemon — production Rust, loads 20+ signed plugins over a stable ABI.
tokio runtime with parallel digest / compress / encrypt stages and native backpressure.
sqlx-backed catalog (PG · MySQL · SQLite). Hash-partitioned, multi-timeline ready.
TLS 1.2+/1.3 enforced on every Director↔SD↔FD↔Console link, with mutual authentication.
Disk, tape and object storage with immutability — native S3, OCI (Oracle-validated), Azure and GCS drivers, plus any S3-compatible endpoint. Omid Cloud S3 WORM-certified; LinuxONE on the way.
Dashed = control channel · solid = data flow. Director, Storage & File daemons, catalog, consoles and every storage target.
Veeam is C#/.NET + C++. Commvault is Java + native libs. NetBackup is C++. All three regularly patch buffer-overflow and use-after-free vulnerabilities. NGBackup's Rust core eliminates that entire bug class by construction — while delivering multicore, zero-copy performance with no garbage-collector pauses.
Strong encryption in transit and at rest, with per-volume keys and optional per-job scope.
Mutual-auth encrypted channels on every link, via rustls — enforced, not optional.
Append-only volumes resist tampering and ransomware encryption. No cleartext hop: every data-plane link can run TLS-PSK end-to-end.
Resource-level access control with full audit routing to file, syslog, catalog and OpenTelemetry.
Plus Ed25519-signed manifests on plugins like MongoDB and File Replication — provable backup integrity.
A real-time agent watches the filesystem (inotify / ReadDirectoryChangesW) with four heuristics — burst rename, suspicious extensions, Shannon-entropy spikes and altered-ratio — then fires up to nine automated responses.
Every daemon — Director, Storage and File — is read, validated, reconfigured and restarted over a single authenticated console channel. No SSH, no co-located config files, no per-daemon login. The GUIs are thin clients: ACL-gated, TLS-encrypted, secret-redacted and fully audited.
Consoles never touch the catalog directly and never shell out to scattered binaries — every action is an ACL-checked, audited console verb with a SHA-256 fingerprint.
Every config write is validate → atomic write + backup → reload → auto-rollback on failure. Mutations are refused over plain TCP.
Daemons still boot from flat files by design — a catalog loss never makes the system un-startable. Structured management, zero bootstrap deadlock.
Inline, global dedup engine in Rust — FastCDC content-defined chunking + a multi-layer Bloom filter over a single shared namespace. Source-side mode chunks at the client and ships only new blocks; storage-side mode dedups at the SD. zstd / LZ4 per chunk.
A redb hot-path index replaces full filesystem walks — 3× faster on Linux, scaling ~20× on 600K-file corpora. Accurate mode skips unchanged files by size, mtime and optional checksum.
Boot a VM directly from storage-daemon bytes over NBD / iSCSI / NFS-datastore / SMB-VHDX — full + incremental chains folded automatically.
Descend into ext2/3/4 & NTFS guests; extract single files without a full disk restore.
Restore Proxmox / KVM / vSphere → Hyper-V and back — automatic qcow2 ↔ VHDX ↔ VMDK conversion. Live-validated on 5 platforms.
Every NGBackup feature is designed from the restore flow backward. Restore Studio delivers instant mount, granular extraction, point-in-time database recovery and true cross-hypervisor migration — the capabilities incumbents gate behind separate licenses.
No à-la-carte per-workload modules. From hypervisors to billion-file HPC filesystems, NGBackup covers the enterprise out of the box.
Native OCI Object Storage driver, Oracle-validated: Standard, Infrequent Access and Archive with automatic thaw, plus WORM immutability (Governance and Compliance) enforced by the backend. An official provider certification — not an untested promise.
End-to-end WORM immutability certified with the shipping NGBackup driver on Omid's S3 object storage — a 100% Brazilian sovereign cloud.
Native SigV4 driver. Standard through Glacier tiers, any S3 region.
Native Shared-Key driver. Hot, Cool, Cold and Archive tiers.
Native driver with service-account OAuth2 over the JSON API v1.
The same S3 driver reaches MinIO, Wasabi, Backblaze B2, Ceph, Swift — or your own on-premises object storage. Mix clouds per job, zero vendor lock-in.
VADP + Changed Block Tracking, 10-mode DR failover/failback/reprotect, TLS replication, network re-IP.
Direct VHDX + RCT change tracking; RCT-push replication to DR (RPO minutes, RTO seconds), Gen1/Gen2 + UEFI preserved.
QEMU dirty-bitmap CBT, instant NBD-overlay boot, seed+bitmap-push replication, guest-consistent snapshots.
Prism CBT (v3/v4 CRT), iSCSI block streaming, alternate-cluster restore, replication to non-Nutanix targets.
3-layer CBT (QMP bitmap + xxHash64 + SIMD zero-detect), KVM direct restore (~10-min RTO), format conversion.
Cross-hypervisor V2V across all five — restore where you need to, hardware-independent DR, zero lock-in.
Data Pump + RMAN (SBT, no staging), TDE-transparent, Data Guard DR, PITR by SCN, ransomware canary.
Up to 64-way striped restore, instant recovery (queryable mid-restore), Always On AG aware, single-table restore.
WAL PITR (time/lsn/xid/name), PG17 incremental, VLDB COPY-range split, backup from standby.
xtrabackup LSN chains, single-table via transportable tablespaces, Galera/Group-Replication aware, CDP binlog.
5 modes incl. sharded + oplog PITR, collection/query granular restore, Ed25519-signed manifests.
Firebird, Informix (native XBSA), Progress OpenEdge, ADABAS — workloads Veeam simply doesn't cover.
Exchange, OneDrive, SharePoint, Teams + Chat via Graph delta APIs. Near-real-time CDC (RPO 60s), GDPR-forget audit trail. A 2.2 MB binary vs 100 MB+ JVM rivals.
Clientless across AD, OpenLDAP, 389DS, FreeIPA. 6 restore modes incl. authoritative, attribute, diff; RFC 4533 syncrepl + DirSync incrementals.
Live NSF backup with granular mailbox/document restore and NSF→EML export. Bacula Enterprise has zero Notes support — we're first.
Billion-file Lustre / GPFS / BeeGFS / CephFS / WekaFS with parallel walkers (10–100× metadata throughput), changelog-native incrementals, Slurm-aware.
Network gear, NAS and cloud SFTP — Cisco, Juniper, Fortinet, Synology, AWS Transfer — via SSH keys, no agent.
Real-time SD-side mirroring with BLAKE3 skip-unchanged, multi-site fan-out, AES-256-GCM at rest, RPO/RTO reporting.
| NGBackup | Veeam | Commvault | NetBackup | |
|---|---|---|---|---|
| Total cost | Low | High | Very high | Very high |
| All 20+ plugins included — no per-workload modules | ✓ | ✗ | ✗ | ✗ |
| Memory-safe + multicore (Rust) | ✓ | ✗ | ✗ | ✗ |
| Real-time ransomware response (Sentinel) | ✓ | ~ | ~ | ✗ |
| Restores never gated by license | ✓ | ✗ | ✗ | ✗ |
| Source-side global deduplication included | ✓ | ~ | ~ | ~ |
| 3× faster incrementals | ✓ | ✗ | ✗ | ✗ |
| Flexible licensing — per agent, per TB or MSP | ✓ | ✗ | ✗ | ✗ |
| Rare workloads (Informix · ADABAS · Notes · HPC) | ✓ | ✗ | ~ | ~ |
License however suits you — per agent, per TB, or an MSP/usage model. No per-feature upsell: every license already includes all plugins, global deduplication, ransomware defense and instant recovery.
Flexible licensing — per agent, per TB or MSP. Your choice.
Rebrand the console with your name and icons — no source changes. Built for resellers and MSPs who deliver backup under their own identity, on the NGBackup engine.
branding.json file, no rebuild.A bad config falls back to the default — it never blocks startup.
Native NAS backup over the Network Data Management Protocol for enterprise filers.
S3, OCI, Azure and GCS drivers already ship. Next: more provider-validated certifications after Oracle OCI and the Omid Cloud S3 WORM cert.
Huawei virtualization (FusionCompute) protection — extending hypervisor coverage further.
BLAKE3-native dedup volumes with point-in-time, git-like restore.
Multi-site federation and opt-in high availability for the Director catalog.
1-click signed, sandboxed plugins installable without restarting the Director.
NGBackup's migration tool imports your existing Bacula catalog, volumes and configuration. Run mixed deployments, migrate at your pace, and cut your backup bill in half, while gaining ransomware defense, instant recovery and 20+ plugins none of the incumbents bundle.
Let's protect your infrastructure — and cut your backup budget in half. Start free, migrate at your pace.
An NGStructures brand · NGBackup · NGCompute