May we count your visit with Google Analytics? It uses cookies and sends visit data to Google. You can change this any time under Cookie choices. Privacy

Backup Storage Prices
Menu

Restore and planning

Immutable backup storage: which vendors support it, and what it costs

Prices checked · Object Lock documentation checked

12 of 18 vendors document Object Lock or an equivalent write-once lock. With it, a 10 TB backup costs least at OVHcloud Object Storage Infrequent Access: $44.65 a normal month; the month you restore it all, Telnyx Cloud Storage Regular Storage costs least at $55.83. All 12 that document a lock offer one that no user, the account's owner included, can lift before its date (a compliance mode, or a locked policy at Azure Blob Storage). Oracle OCI Object Storage and Cloudflare R2 are listed apart: each has its own bucket retention rules instead of S3 Object Lock (Oracle OCI Object Storage's cannot be used on a bucket with versioning turned on; Cloudflare R2's can be removed by a bucket admin).

Vendor and offer Object LockLock modes 10 TB normal month10 TB restore month
OVHcloud Object Storage Infrequent Access Yes, S3 Object LockCompliance and governance $44.65 $85.25
Telnyx Cloud Storage Regular Storage Yes, S3 Object LockCompliance and governance (US, APAC and CA buckets only) $55.83 $55.83
IDrive e2 Yes, S3 Object LockCompliance and governance $60.00 $60.00
Backblaze B2 B2 Cloud Storage Yes, S3 Object LockCompliance and governance $69.43 $69.43
Wasabi Hot Cloud Storage Yes, S3 Object LockCompliance and governance $72.67 $72.67
Storj Standard Yes, S3 Object LockCompliance and governance $77.00 $147.00
Hetzner Object Storage Object Storage Yes, S3 Object LockCompliance and governance $88.80 $100.69
Scaleway Object Storage Standard One Zone Yes, S3 Object LockCompliance and governance $100.51 $212.75
Amazon S3 S3 Glacier Instant Retrieval Yes, S3 Object LockCompliance and governance $170.01 $1,297.60
Azure Blob Storage Cold LRS Yes, as Azure immutability (WORM) policiesLocked policies nobody can shorten or delete; unlocked policies for testing $170.83 $1,347.23
Google Cloud Storage Coldline Yes, as Object Retention Lock and Bucket LockCompliance and governance $185.04 $1,498.89
Akamai Cloud Object Storage Object Storage Yes, S3 Object LockCompliance and governance $200.00 $250.00
Vultr Object Storage Standard Unclear: the vendor's pages leave a gapNot documented $180.00 $280.00
Tigris Archive Instant Retrieval Not documentedNot documented $68.59 $348.49
DigitalOcean Spaces Spaces Cold Storage Not documentedNot documented $70.19 $171.71
Oracle OCI Object Storage Infrequent Access Its own retention rules, not Object LockLocked rules nobody can shorten or delete, after a 14-day delay; unlocked rules $103.08 $203.01
Cloudflare R2 Infrequent Access Its own retention rules, not Object LockRules a bucket admin can remove $120.80 $221.70
Filebase Object Storage NoNo lock $139.70 $139.70

Each vendor's cheapest offer with its strongest lock, on 10 TB kept, 1 TB downloaded in a normal month, all 10 TB in the month you restore; readable at once, with no archive restore step, where the vendor has such an offer. Lock modes as each vendor's lock documentation names them, read on 11 October 2026; Azure and Oracle use their own words, not governance and compliance.

Two kinds of lock, and who can open them

Governance modeAn administrator given the bypass permission can shorten the lock or delete early. It stops mistakes and most scripts, not someone holding that permission.

Compliance modeNobody can shorten the lock or delete the data before the date, the account's root user included. The lock opens only when its date arrives.

Either way the data is billed until the lock ends. A 90-day lock on 10 TB at Scaleway Object Storage Glacier keeps $28.51 a month on the bill for three months, $85.53 in all, even if the backup is no longer wanted after the first.

The two modes as Amazon S3 Object Lock defines them; S3-compatible vendors that document Object Lock use the same two. Azure, Google Cloud, Cloudflare R2 and Oracle use locks of their own, as the tables below show.

What DORA, NIS2 and the UK's bill say about backups

None of the three names a storage vendor, Object Lock or immutability. Each sets duties for the organisations it covers, and those organisations ask the same of their suppliers. Below is what each official text says, read on ; it is not legal advice, and storing backups with any vendor here does not by itself make anyone compliant.

DORA, Article 12(3)
EU banks, insurers, investment firms and other financial entities. Applies from 17 January 2025.
“When restoring backup data using own systems, financial entities shall use ICT systems that are physically and logically segregated from the source ICT system.”
Article 12 also asks for written backup policies with a scope and a minimum frequency, and for backup and restore procedures to be tested periodically. A firm's contracts with cloud storage providers fall under DORA's third-party rules (Articles 28 to 30).
NIS2, Article 21(2)(c)
Essential and important entities in the EU, cloud computing and data centre providers among them. EU countries had to apply it from 18 October 2024; several passed their own laws later.
“business continuity, such as backup management and disaster recovery, and crisis management”
It is one of the minimum risk-management measures Article 21 lists. NIS2 is a directive, so the duty reaches a company through its own country's law.
UK Cyber Security and Resilience Bill, clauses on data centres and managed service providers
Operators of essential services in the UK, and under the bill data centres and managed service providers. Not yet law when we read Parliament's bill page on 31 October 2026: the House of Lords held its report stage on 26 October, and the bill still needs a Lords third reading, Commons agreement to any Lords changes, and Royal Assent.
“Data centres will be classed as essential services, and data infrastructure as a NIS sector. ... Medium and large managed service providers will be brought into scope”
The quote is the government's own summary of the bill. Its clauses may still change before Royal Assent.

The table above shows which vendors offer a compliance mode, which nobody can lift before its date; the residency guide shows where each vendor stores data.

Put your own numbers through the calculator to see what this charge does to a normal month and to the month you restore.

Object Lock support is necessary, but the backup tool decides eligibility

An immutable target must prevent deletion or overwrite for the required retention period and must be configurable by the selected backup tool. S3 compatibility alone is not enough: the storage API must expose the exact retention operations the tool uses, and the tool must support the vendor's mode and bucket configuration. [1] [9]

Governance mode is bypassable by a specifically authorized identity. Compliance mode cannot be shortened or bypassed during retention, including by the account root in Amazon S3. Native systems such as Azure immutable Blob Storage, Cloudflare R2 bucket locks, Google Cloud locks, and Oracle retention rules use different controls, so their rows explain the mapping instead of forcing S3 labels onto them. [1] [4] [5] [6] [7]

A named tool in the table below means the vendor or tool documentation explicitly describes immutable use. It is not a test result. not published means the checked official documentation did not verify that cell; it never means false or zero. No provider receives a score or best label. [3] [10] [11]

RequirementWhat must be documentedIf it is missingSource
Immutable storage control Documented WORM, Object Lock, or native retention control that blocks deletion or overwrite not published, not comparable, or false [1] [4] [5]
Retention mode Governance bypass behavior and compliance non-bypass behavior, or a precise native equivalent not published or not comparable [1] [4] [6]
Versioning prerequisite Required, automatic, conditional, incompatible, or stated as not required not published [1] [4] [8]
Retention limit Published minimum and maximum, or not published where no limit is documented not published [2] [4] [10]
Backup-tool compatibility Named immutable integration and its mode or configuration constraints not published or false [3] [10] [11] [12]

What each of the 18 vendors documents for immutable storage

The table below covers all 66 offers we checked, with one row for each of the 18 vendors. Provider-level documentation applies only to the offer scope stated in each row. Amazon S3 Express One Zone, Telnyx's EU location, and any other documented exception remain outside a broad supported label. [13] [43]

A true support value means official documentation describes the storage control. It does not prove that every backup tool works. A false value is used only where the published capability list rules out the required control. Native retention systems receive not comparable when governance and compliance are not the vendor's actual modes. [18] [41] [7]

Retention ranges show only published limits. When a vendor accepts days or years but does not publish the maximum in the checked documentation, the cell states maximum not published rather than assuming the Amazon S3 limit. [19] [25] [29]

Show the table (18 vendors)
ProviderOffers we checkedWhat the documentation shows for each offerLimitsSource
Amazon S3 16 14 supported; 2 does not apply Express One Zone directory buckets are outside the general-purpose-bucket Object Lock scope [1] [13]
Azure Blob Storage 8 8 supported Uses Azure container-level or version-level WORM controls rather than S3 naming [4]
Google Cloud Storage 9 9 supported Uses Object Retention Lock and Bucket Lock; tool workflows can add versioning requirements [6] [16] [17]
Cloudflare R2 2 2 not comparable Native bucket locks exist, but S3 Object Lock APIs are not implemented and native rules are removable [5] [18]
Backblaze B2 1 1 supported Veeam compatibility is documented, but another tool still requires its own qualification [10]
Wasabi 1 1 supported Veeam requires Compliance mode and vendor-specific bucket configuration [19] [11]
IDrive e2 1 1 supported Numeric retention limits and a separate versioning prerequisite are not published [20] [21] [12]
DigitalOcean Spaces 2 2 not published Write headers are documented, but the bucket-level Object Lock enforcement contract is not [23] [22] [24]
Scaleway Object Storage 3 3 supported A numeric maximum retention and named immutable-backup integration are not published [25]
OVHcloud Object Storage 5 4 supported; 1 conditional Current OVHcloud pages disagree about Object Lock support for Cold Archive [26] [27] [28]
Hetzner Object Storage 1 1 supported The Veeam path has vendor-stated configuration and license requirements [29] [31]
Akamai Cloud Object Storage 1 1 supported Object Lock is documented on all E0 through E3 endpoint types; named backup-tool qualification is not published [32]
Vultr Object Storage 5 5 conditional The feature toggle and IAM actions are published, but retention-mode enforcement is not; Archive also conflicts with versioning [34] [35] [36]
Storj 1 1 supported A separate versioning prerequisite and numeric maximum retention are not published [37] [38]
Oracle OCI Object Storage 3 3 not comparable OCI uses native retention rules that are incompatible with Object Versioning, not the S3 Object Lock API [7] [8]
Tigris 4 4 not published Object Lock IAM actions and request names are published, but retention-mode enforcement is not documented [40] [39]
Filebase 1 1 unsupported The published S3 capability list does not provide the required versioning and Object Lock operations [41] [42] [13]
Telnyx Cloud Storage 2 1 supported; 1 does not apply The current Object Lock guide limits support to US buckets, excluding the EU offer [43]

Documentation narrows the field but does not pick a winner

Amazon S3, Azure Blob Storage, Google Cloud Storage, Backblaze B2, Wasabi, IDrive e2, Scaleway, OVHcloud, Hetzner, Akamai, Storj, and US-region Telnyx publish an immutable storage control in the checked official documentation. Their retention modes, limits, region scope, and named backup-tool evidence are not interchangeable. [1] [4] [6] [10] [19] [20] [25] [26] [29] [32] [37] [43]

Cloudflare R2 and Oracle OCI publish native retention controls that are not comparable to full S3 governance and compliance modes. DigitalOcean, Vultr, and Tigris remain not published where official material did not verify the required support. Filebase is false for the current S3 Object Lock requirement because its published S3 compatibility table does not support the needed write-side versioning behavior. [18] [7] [22] [33] [39] [41]

Price cannot resolve the remaining choice. The buyer must first name the backup tool, required immutable mode, retention period, region, workload type, restore destination, and recovery volume. Only vendors whose documented controls and tool workflow satisfy all of those requirements are comparable, and egress belongs in the final recovery bill. [3] [11] [12] [10]

What vendors publishProvidersWhat the label does not proveSource
Immutable control published Amazon S3, Azure Blob Storage, Google Cloud Storage, Backblaze B2, Wasabi, IDrive e2, Scaleway, OVHcloud, Hetzner, Akamai, Storj, Telnyx US It does not prove every class, region, backup tool, or retention period is eligible [1] [4] [6] [10] [19] [20] [25] [26] [29] [32] [37] [43]
Native control, not S3 governance/compliance Cloudflare R2, Oracle OCI Object Storage It does not prove compatibility with a tool that requires the S3 Object Lock API [5] [18] [7]
Required contract not published DigitalOcean Spaces, Vultr Object Storage, Tigris It does not mean unsupported; it prevents a sourced eligibility claim [22] [33] [39]
Current published capability rules out S3 Object Lock target Filebase It does not make a claim about future support or a non-S3 retention product [41] [42]

Sources

Every figure above comes from one of these pages, on the date shown. Each numbered reference in the text links to its entry here. Vendors change prices; if a date looks old, check the source. Three vendors publish a downloadable price feed and the rest are re-checked by hand, which is why the dates are not uniform.

Source pages checked 43 sources
  1. 1 Amazon S3 docs: Locking objects with Object Lock docs.aws.amazon.com · checked 26 July 2026
  2. 2 Amazon S3 docs: Object Lock considerations docs.aws.amazon.com · checked 26 July 2026
  3. 3 AWS: Amazon S3 Object Lock aws.amazon.com · checked 26 July 2026
  4. 4 Azure docs: Immutable storage for blob data learn.microsoft.com · checked 26 July 2026
  5. 5 Cloudflare R2 docs: Bucket locks developers.cloudflare.com · checked 26 July 2026
  6. 6 Google Cloud Storage docs: Object Retention Lock docs.cloud.google.com · checked 26 July 2026
  7. 7 Oracle docs: Creating an Object Storage retention rule docs.oracle.com · checked 26 July 2026
  8. 8 Oracle docs: Object Storage versioning docs.oracle.com · checked 26 July 2026
  9. 9 Veeam guide: Immutability for backup files helpcenter.veeam.com · checked 26 July 2026
  10. 10 Backblaze docs: Cloud Storage Object Lock www.backblaze.com · checked 26 July 2026
  11. 11 Wasabi docs: Veeam Object Lock integration docs.wasabi.com · checked 26 July 2026
  12. 12 IDrive e2: Veeam with Object Lock www.idrive.com · checked 26 July 2026
  13. 13 Amazon S3 docs: Configuring S3 Object Lock docs.aws.amazon.com · checked 26 July 2026
  14. 14 Veeam Backup for Azure guide: Immutability helpcenter.veeam.com · checked 26 July 2026
  15. 15 Veeam KB 4241: Using object storage with Veeam products www.veeam.com · checked 26 July 2026
  16. 16 Google Cloud Storage docs: Bucket Lock docs.cloud.google.com · checked 26 July 2026
  17. 17 Veeam guide: Backup immutability (SQL Server plug-in) helpcenter.veeam.com · checked 26 July 2026
  18. 18 Cloudflare R2 docs: S3 API compatibility developers.cloudflare.com · checked 26 July 2026
  19. 19 Wasabi docs: Enabling Object Lock docs.wasabi.com · checked 26 July 2026
  20. 20 IDrive e2: Object Lock www.idrive.com · checked 26 July 2026
  21. 21 IDrive e2: FAQs about objects www.idrive.com · checked 26 July 2026
  22. 22 DigitalOcean docs: Spaces S3 compatibility docs.digitalocean.com · checked 26 July 2026
  23. 23 DigitalOcean docs: Spaces API reference docs.digitalocean.com · checked 26 July 2026
  24. 24 DigitalOcean docs: How to configure Spaces versioning docs.digitalocean.com · checked 26 July 2026
  25. 25 Scaleway docs: How to use object lock www.scaleway.com · checked 26 July 2026
  26. 26 OVHcloud docs: Managing immutability with Object Lock (WORM) help.ovhcloud.com · checked 26 July 2026
  27. 27 OVHcloud docs: Object Storage FAQ help.ovhcloud.com · checked 26 July 2026
  28. 28 OVHcloud docs: Cold Archive FAQ help.ovhcloud.com · checked 26 July 2026
  29. 29 Hetzner Object Storage docs: Object Lock retention docs.hetzner.com · checked 26 July 2026
  30. 30 Hetzner Object Storage FAQ: Buckets and objects docs.hetzner.com · checked 26 July 2026
  31. 31 Hetzner Object Storage docs: Setting up Veeam docs.hetzner.com · checked 26 July 2026
  32. 32 Akamai Object Storage docs: Object Lock techdocs.akamai.com · checked 26 July 2026
  33. 33 Vultr docs: S3 compatibility matrix docs.vultr.com · checked 26 July 2026
  34. 34 Vultr docs: How to manage Object Storage buckets docs.vultr.com · checked 26 July 2026
  35. 35 Vultr docs: Storage actions for IAM policies docs.vultr.com · checked 26 July 2026
  36. 36 Vultr docs: Object Storage subscription limits docs.vultr.com · checked 26 July 2026
  37. 37 Storj docs: Object Lock storj.dev · checked 26 July 2026
  38. 38 Storj: Secure cloud storage www.storj.io · checked 26 July 2026
  39. 39 Tigris pricing www.tigrisdata.com · checked 26 July 2026
  40. 40 Tigris docs: Authentication and authorization www.tigrisdata.com · checked 26 July 2026
  41. 41 Filebase docs: S3 compatibility matrix filebase.com · checked 26 July 2026
  42. 42 Filebase docs: Buckets and objects filebase.com · checked 26 July 2026
  43. 43 Telnyx docs: Object Lock and retention developers.telnyx.com · checked 26 July 2026