Immutable Proxmox backup with Cubbit

Protected backups, always available and ready to restore

With AXOL Server, you can design an immutable backup strategy for Proxmox environments, based on Proxmox Backup Server, Cubbit DS3, and Rai Way infrastructure

Talk to an AXOL Server specialist

Immutable backup for Proxmox infrastructure

Immutable Proxmox backup with Cubbit DS3 is an architecture designed to protect backup copies from ransomware, human error, compromised access, and accidental deletion.

The solution combines Proxmox Backup Server for backup management, Cubbit DS3 as S3-compatible object storage, and Object Lock/WORM to make backup copies immutable for a defined period. The goal is simple: to ensure you have a reliable copy to restore from, even when the primary infrastructure has been compromised.

Cubbit & Rai Way

Italian infrastructure with Cubbit and Rai Way

The AXOL Server service is provided through integration with Cubbit and Rai Way, combining distributed object storage, Italian infrastructure, and advanced data protection.

Rai Way has integrated Cubbit technology into five data centers across Italy: Venice, Turin, Milan, Genoa, and Florence. Rai Way’s proprietary network infrastructure helps make the solution suitable for backup, disaster recovery, and business continuity scenarios.

This architecture supports companies in their efforts to comply with the NIS2 Directive and pursue ISO/IEC 27001 certification, the international standard for Information Security Management Systems. Immutable backup is an important technical measure for strengthening availability, integrity, data protection, and recovery capabilities.

The role of Cubbit DS3

Cubbit DS3 is used as an off-site S3-compatible destination for storing backups outside the primary environment. Compared with simple cloud storage, Cubbit DS3 makes it possible to build a stronger backup and disaster recovery strategy: data can be stored in an external, scalable, distributed environment designed to increase operational resilience.

For companies using Proxmox, the benefit is not only having a copy in the cloud. The real benefit is having a destination designed to protect critical backups and make them available when needed.

How the solution works

AXOL Server designs the integration starting from the existing Proxmox infrastructure.

Proxmox Backup Server manages backup copies and the operational logic of the backup process. Cubbit DS3 is configured as an external S3-compatible destination, while retention policies define how long copies must be stored and protected.

When included in the project, Object Lock/WORM prevents modification or deletion until the defined expiration date. The configuration must be designed correctly from the outset, especially for buckets, permissions, retention, local cache, security, and restore procedures.

What AXOL Server does

Our systems engineers manage the entire process:

analysis of the existing Proxmox infrastructure
definition of the backup and retention strategy
configuration of Proxmox Backup Server
integration with Cubbit DS3
configuration of Object Lock/WORM logic
backup integrity checks
restore testing
technical support and maintenance

The most important part is the restore test: an unverified backup is only a promise. A tested backup provides a real recovery path.

Immutable backup

Why adopt an immutable backup strategy

An immutable backup strategy reduces the risk of ransomware compromising backup copies, improves business continuity, and strengthens recovery capabilities in the event of an incident.

For companies using Proxmox, this means being able to rely on backups that are separate from the primary infrastructure, protected from unauthorized changes, and designed to be truly recoverable.

The solution also supports disaster recovery, audits, internal policies, and information security compliance initiatives.

Important considerations
Immutable backup does not replace a complete cybersecurity strategy. It does not eliminate the need to protect access, networks, endpoints, systems, and credentials. It adds a fundamental layer: a protected copy that cannot be modified or deleted before the scheduled expiration date. With Cubbit DS3, Object Lock must be enabled when the bucket is created. If the bucket is created without Object Lock, it cannot be added later to the same bucket.

This is why initial design is essential.