split
true
white-70
RUBRIK CLOUD VAULT
Immutable, Credential-Gapped Data - Fully Isolated
A stolen production credential can reach your local snapshots and your cloud replicas, because they answer to the same identity. Rubrik Cloud Vault sits off your network, inside an isolated, Rubrik-managed identity domain, with immutability on by default. Rubrik provisions and runs it, so there is nothing for your team to manage.
button
primary
lg
true
full
button
secondary
lg
true
full
link
primary
lg
true
full
false
button
primary
lg
true
_self
full
variant
center
eyebrow
WHAT IS RUBRIK CLOUD VAULT
heading
Your backup is a recovery option, only if the attacker cannot change or delete it.
subheading
Most backup architectures share one failure. Local snapshots, multiple infrastructure components, and customer-owned cloud archives answer to the same identity provider as the systems they protect, so one compromised admin account can reach production and recovery together. Rubrik Cloud Vault is a fully managed cloud vault that Rubrik provisions, secures, and operates inside an isolated, Rubrik-managed identity domain. Your production credentials do not work there. Every copy is immutable from the moment it lands, retention is locked to the SLA you already set, and you choose the cloud, the region, and the redundancy. There is no cloud infrastructure for your team to build, secure, or monitor.
stat
TRUSTED BY
2,500+
Organizations trust Rubrik Cloud Vault to hold an isolated copy of their data.
stat
ENTRUSTED TO RCV
1 Exabyte
Approaching one exabyte of customer data is entrusted to Rubrik Cloud Vault, and the number keeps climbing.
stat
WARRANTY
Up to $10M
Data in the Backup tier with immutability and Instant Archive enabled qualifies for the Rubrik Ransomware Recovery Warranty.
Built to survive a compromised production environment.
Moving a copy offsite does nothing if the same credentials still administer it. Rubrik Cloud Vault moves the copy into an isolated, Rubrik-managed identity domain, locks it on write, and takes the operating burden with it.
Credential-Gapped and Immutable
Your production identity has no account in the vault, and every copy is locked the moment it lands. A compromised admin cannot delete your recovery data, encrypt it, or shorten its retention.
Simple and Flexible
Provision in minutes, point an SLA at it, and stop thinking about it. All-inclusive pricing, your choice of cloud, region, and redundancy, and no additional infrastructure to build, secure, or manage.
Built to Comply with Regulatory Requirements
Object-level immutability, retention lock, encryption with your own key, and quorum approval help you meet regulatory requirements, and produce the audit evidence regulators and insurers ask for.
40
40
RUBRIK CLOUD VAULT CAPABILITIES
What makes the vault credential-gapped, immutable, and simple to run.
Isolation + Immutability
Your production identity has no account here, and neither does anyone else's.
- Rubrik-managed identity domain, isolated from your identity provider.
- Always-on object-level WORM immutability, retention from your SLA.
- Quorum authorization before a location is paused or deleted.
false
false
link
primary
md
true
content
Simplicity
Configure it once, then watch capacity and nothing else.
- Provision a vault and start backing up within minutes.
- All-inclusive pricing, so recovery does not produce a separate retrieval bill.
- No additional infrastructure to build, secure, or monitor.
false
false
link
primary
md
true
content
Compliance
The controls your auditor asks about, already switched on.
- Object-level immutability and retention lock for WORM record keeping.
- Role-based access control and quorum authorization for separation of duties.
- Supports FINRA, SEC 17a-4(f) and 18a-6(e), CFTC 1.31, and DORA requirements.
false
false
link
primary
md
true
content
RUBRIK CLOUD VAULT CUSTOMER STORIES
Over 2,500 organizations trust Rubrik Cloud Vault to hold their last clean copy outside their own identity domain.
false
1 Exabyte
of customer data entrusted to Rubrik Cloud Vault.
“Rubrik allows us to be fully DORA compliant, while providing us with the ability to store and secure data outside our infrastructure.”
Jean-Christophe Normand
Group CTO, Redion
RUBRIK CLOUD VAULT USE CASES
Real-world isolated backup scenarios powered by Rubrik.
Your production environment is compromised.
An attacker has taken over parts of your production environment and starts moving toward the backups and archives. The vault runs under Rubrik's identity, so nothing from production authenticates there, and quorum approval blocks any single account from removing data early. Outcome: the recovery option survives the breach.
An auditor or an insurer asks for proof.
A regulator, an examiner, or a cyber insurance carrier wants evidence of an encrypted, immutable copy held separately from primary infrastructure. The vault provides WORM retention, separation of duties, and customer-held keys, documented rather than asserted. Outcome: the evidence exists before anyone asks for it.
Your primary site or cloud goes down.
A disaster or outage takes down your data center or your primary cloud region, and the local backups go with it. A clean copy is already in the vault, so you can spin up a new environment and recover clean data from it. Outcome: recovery is not blocked by the building or the region.
You want an offsite copy in the cloud without the management overhead.
You need a protected copy in the cloud, but not the accounts, storage policies, and security posture that come with building it yourself. Rubrik builds, secures, and monitors the vault. Outcome: cloud-grade isolation without cloud overhead.
RESOURCES & EXPERTISE
Learn more from our experts
Guided Demo
10 min
Rubrik Cloud Vault Storylane demo
Provision a vault, attach an SLA, and restore from an isolated copy, in about ten minutes.
White paper
8 min read
How It Works: Rubrik Cloud Vault for AWS
Architecture, resource isolation, immutability locks, and encryption, written for the architects who will review it.
_self
White paper
18 pages
Rubrik Cloud Vault for Microsoft Azure Technical Deepdive
Discover how Rubrik Cloud Vault provides secure, immutable, offsite backup storage with simplified operations and predictable costs.
FAQ
Everything you need to know
bg-surface-muted
What does credential-gapped mean, and why does it matter?
Credential-gapped means the vault does not recognize your production credentials at all. It runs inside Rubrik's identity domain, not yours, so an attacker holding a privileged account in your environment has nothing to authenticate against. A copy in your own cloud account is still administered by the identity provider an attacker just compromised, and without that separation the same breach that takes production also takes the recovery option.
What is immutability, and what happens without it?
Immutability means a backup cannot be changed or deleted before its retention expires, by anyone, including an administrator. Rubrik Cloud Vault writes every object under a WORM lock the moment it lands, with retention taken from your SLA, so there is no unprotected window and no lock period to calculate by hand. Without it, an attacker who reaches the backup can encrypt it, overwrite it, or shorten its retention.
Why do I need isolation, immutability, and a managed service together?
Because each one covers what the others miss. Isolation stops an attacker from reaching the copy. Immutability stops anyone who does reach it from changing it. A managed service stops the misconfiguration that quietly undoes both, since most cloud storage failures come from access policy and retention settings that were set once and never checked. Any one on its own leaves a path through.
Can I choose which cloud to put the vault in?
Yes. Rubrik Cloud Vault runs on Microsoft Azure, Amazon Web Services, and Google Cloud, in the region you select. You also choose the tier and the redundancy, so you can match each workload to the protection it needs.” The current text repeats “redundancy” and says “entitlements sold by tier and redundancy.
How does Rubrik Cloud Vault help me meet different compliance requirements?
By giving you the specific controls the frameworks ask for, already switched on. Object-level immutability and retention lock cover WORM record keeping. Role-based access control and quorum authorization demonstrate separation of duties. Client-side encryption with a key Rubrik cannot recover answers the confidentiality questions. Together these support FINRA, SEC 17a-4(f) and 18a-6(e), CFTC 1.31, and DORA requirements.
What workloads can I protect with Rubrik Cloud Vault?
On-premises workloads, unstructured data through NAS Cloud Direct, and cloud-native workloads across AWS, Azure, and Google Cloud, all under the same SLA policy and the same control plane.