sota.io
2026-05-19·5 min read·sota.io Team

Acronis EU Alternative 2026: CLOUD Act Risk, GDPR Compliance, and Bareos vs Restic

Post #1157 in the sota.io EU Cloud Sovereignty Series — EU Backup & Recovery Series #2/5

Acronis EU Alternative 2026: Swiss headquarters vs US subsidiary CLOUD Act risk analysis and Bareos comparison for GDPR compliance

Acronis presents one of the most carefully constructed corporate narratives in enterprise software: a Swiss headquarters, a privacy-first brand position, and marketing that emphasises European data sovereignty. Yet beneath that narrative sits a US operational subsidiary, a dedicated US federal government contractor entity, and a Goldman Sachs investment — each of which creates CLOUD Act exposure for the backup data of EU organisations.

Backup data is uniquely sensitive under GDPR. It contains a complete, point-in-time copy of everything your organisation holds: databases, emails, credentials, personal records, system configurations. When that backup infrastructure has any US-jurisdictional link, it creates a direct pathway for US surveillance law to reach EU personal data — regardless of where the actual backup files are stored.

This post scores Acronis on our 25-point CLOUD Act exposure methodology, maps the five specific GDPR Article 44 transfer risks, and presents EU-native alternatives: Bareos (Germany), SEP sesam (Germany), BorgBackup, and Restic on Hetzner — all at 0/25 CLOUD Act exposure.

Acronis: The Swiss Brand with US Operational Roots

Acronis was founded in 2003 and built its reputation on backup and disk imaging software. Today it markets Acronis Cyber Protect Cloud as a unified cybersecurity and backup platform for managed service providers (MSPs).

The Swiss Holding (Partially Positive): Acronis AG is incorporated in Schaffhausen, Switzerland. Swiss data protection law (the revised Federal Act on Data Protection, nFADP, in force since September 2023) is largely aligned with GDPR principles and includes transfer restrictions similar to Chapter V. A Swiss corporate parent is a stronger privacy shield than a Cayman Islands or Delaware holding company. Switzerland is not an EU Member State, but it has adequacy status under GDPR (Commission Decision 2000/518/EC), which was reconfirmed pending a formal reassessment under the new Swiss nFADP.

The US Operational Reality: Beneath the Swiss parent, Acronis operates substantial US infrastructure. Acronis, Inc. is a US-based entity headquartered in Burlington, Massachusetts (some sources list Woburn or Waltham — the Burlington MA area). This entity employs hundreds of US-based engineers, sales staff, and support personnel. Under the CLOUD Act (18 U.S.C. § 2713), any US entity can be compelled to produce data "regardless of where such data is stored." The Swiss parent's structure does not eliminate this risk when a US subsidiary conducts substantial business activities.

Acronis SCS LLC — The Federal Risk: Acronis has a dedicated US Federal Government division: Acronis SCS LLC, based in Woburn, Massachusetts. Acronis SCS holds US federal contracts to provide cybersecurity solutions to US government agencies. This entity is explicitly designed to operate under US Government procurement rules, which require full compliance with US intelligence requirements. The existence of a federal contractor entity within the Acronis corporate family creates a significantly elevated risk profile for EU customers — US intelligence agencies have established legal pathways to data held by or accessible to federal contractors.

The Goldman Sachs Investment: In November 2022, Acronis raised $250 million in a growth equity round led by Goldman Sachs Asset Management. Goldman Sachs Asset Management (GSAM) is a division of The Goldman Sachs Group, Inc., a US financial institution incorporated in Delaware and headquartered in New York City. As a significant investor with board representation and management agreements, Goldman Sachs creates an additional US-jurisdictional hook. US authorities can subpoena US financial institutions to produce documents and communications related to their portfolio companies — including information about corporate operations, data handling practices, and customer relationships.

Earlier Investment: CVC Capital Partners: Acronis raised earlier funding from CVC Capital Partners, a Luxembourg-headquartered private equity firm. CVC is incorporated in the EU and is not subject to US CLOUD Act compulsion in the same way as a US entity. This is a mitigating factor compared to Veeam's Insight Venture Partners (pure US PE, Delaware). However, CVC's international operations and LP relationships with US pension funds and endowments introduce indirect exposure.

CLOUD Act Exposure Score: 14/25

DimensionScoreRationale
Corporate jurisdiction2/5Swiss AG parent (strong positive) but US subsidiary Acronis Inc. and Acronis SCS LLC are direct US-jurisdiction entities
Data flows3/5US-region cloud data centers available; agent telemetry, threat intelligence (Acronis Active Protection), and support routing through US infrastructure
Investor/PE exposure2/5Goldman Sachs GSAM (US, significant) + CVC Capital (Luxembourg, lower risk) — mixed profile, better than pure US PE
CLOUD Act direct4/5Acronis Inc. (Burlington MA) and Acronis SCS LLC (Woburn MA) are directly subject; statutory obligations cannot be contractually waived
Intelligence links3/5Acronis SCS LLC holds US federal government contracts — elevated intelligence risk compared to typical enterprise software vendors

Total: 14/25 — Moderate-High CLOUD Act Exposure

For comparison: Veeam scores 15/25 (higher due to Insight VP's pure-US PE structure), but Acronis SCS's federal contractor role creates a more direct intelligence pathway than Veeam's Kasten acquisition.

Five GDPR Article 44 Transfer Risks

GDPR Article 44 prohibits transfers of personal data to third countries unless an appropriate safeguard exists. When Acronis processes backup data and that processing involves a US entity, each of the following creates a potential Article 44 violation:

Risk 1: Acronis Cloud Data Centers in US Regions

Acronis Cyber Protect Cloud offers customers the choice of data center region. However, the default configuration, the global management plane, and multi-region redundancy features can all result in backup metadata — and in some configurations, backup data itself — flowing to US-based infrastructure.

What gets transferred: Backup job metadata (timestamps, file hashes, deduplication indices), restore point catalogues, agent status telemetry. In some configurations, actual backup data depending on selected cloud region.

GDPR exposure: If EU personal data is included in backups (and for business applications, it always is), routing that data through US infrastructure without a valid transfer mechanism violates Article 44. Standard Contractual Clauses under Acronis's DPA do not override US surveillance law obligations — the Schrems II ruling (C-311/18) established that SCCs cannot override Chapter V-equivalent surveillance frameworks.

Mitigation: Use Acronis on-premises (Acronis Backup Advanced, self-hosted) with EU-based storage targets only. Disable all cloud-connected features. This eliminates most data transfer risks but requires on-premises infrastructure investment.

Risk 2: Acronis SCS LLC — Federal Contractor Jurisdiction

Acronis SCS LLC is a US federal government contractor based in Woburn, Massachusetts. Its existence creates a structural risk that goes beyond typical corporate subsidiary exposure.

The mechanism: Federal contractors operate under US Government procurement rules including the Federal Acquisition Regulation (FAR) and Defense Federal Acquisition Regulation Supplement (DFARS). These rules require contractors to cooperate with US Government investigations and to notify the government of cyber incidents. They can also impose obligations to provide US agencies with access to contractor systems and data.

The EU impact: Acronis SCS LLC shares the Acronis brand, technology platform, and corporate parent with the EU-facing Acronis AG. If US intelligence agencies access Acronis SCS systems, they gain access to the shared technology stack — which includes components deployed globally. Even if EU customer data is technically isolated in Acronis AG systems, shared infrastructure creates potential cross-contamination.

GDPR exposure: Any processing of EU personal data using shared infrastructure or shared software components that are accessible to a federal contractor entity creates a potential Article 44 violation. The risk is structural and cannot be addressed by contractual agreements alone.

Risk 3: Goldman Sachs Investor Access

Goldman Sachs Asset Management's $250M investment in Acronis creates an ongoing US-jurisdictional link through investor rights and board representation.

Standard investor agreements provide:

The CLOUD Act pathway: Under US law, Goldman Sachs as a US financial institution can be served with a subpoena or national security letter requiring it to produce any documents in its possession relating to Acronis — including information obtained through its investor rights. A subpoena served on Goldman Sachs in New York does not require any action by Acronis AG in Switzerland.

GDPR exposure: If Goldman Sachs's investor information rights cover operational data that includes details of EU customer backup operations (customer names, sectors, backup volumes, system topologies), the information sharing between Acronis AG and Goldman Sachs constitutes a transfer to a US entity without an Article 44 safeguard.

Risk 4: Acronis Agent Telemetry and Active Protection

Every Acronis Cyber Protect installation includes an agent that runs on protected systems. By default, these agents transmit telemetry to Acronis-operated infrastructure.

What the agent transmits:

GDPR exposure: Hardware fingerprints and system configuration data from EU infrastructure constitute personal data relating to identified natural persons (system administrators, data subjects whose data the protected system holds). Transmitting this data to US-hosted Acronis infrastructure creates an Article 44 transfer. The Active Protection threat intelligence feature is particularly problematic: it shares file behaviour patterns from protected systems with Acronis's global threat intelligence network, which includes US-operated nodes.

Mitigation: Acronis allows disabling of telemetry and cloud-connected threat intelligence features in enterprise configurations. However, disabling these features requires manual configuration and is not the default. Many MSPs and enterprise customers deploy Acronis without modifying these defaults.

Risk 5: Cyber Protect Cloud MSP Portal and Support Infrastructure

Acronis Cyber Protect Cloud is primarily sold through managed service providers (MSPs). The MSP management portal, billing infrastructure, and technical support system are operated by Acronis at the group level — with significant US infrastructure involvement.

What flows through US infrastructure:

GDPR exposure: MSP customers manage EU end-customer data through the Acronis portal. If the portal itself routes data through US infrastructure, or if support interactions involve US-based engineers accessing EU customer data, this creates an Article 44 violation. The DPA between Acronis and the MSP does not resolve the underlying jurisdictional issue.

EU-Native Alternatives: 0/25 CLOUD Act Exposure

The following alternatives are incorporated in EU member states or with EU-only ownership and operations, and score 0/25 on our CLOUD Act exposure methodology.

Bareos — Open Source Enterprise Backup from Cologne

What it is: Bareos (Backup Archiving REcovery Open Sourced) is a fork of Bacula Enterprise, developed and maintained by Bareos GmbH in Cologne, Germany. It is released under GPL2 and provides enterprise-grade backup for heterogeneous environments.

CLOUD Act exposure: 0/25

Technical capabilities:

Cost comparison:

Limitations: Configuration is more complex than Acronis's unified platform. Requires dedicated infrastructure investment. No integrated EDR/antivirus (unlike Acronis Cyber Protect's unified approach). GUI is functional but less polished than commercial alternatives.

SEP sesam — Enterprise Backup from Waldorf

What it is: SEP sesam is a commercial backup and disaster recovery platform developed by SEP AG, headquartered in Waldorf, Germany. It is targeted at medium-to-large enterprises and supports heterogeneous environments.

CLOUD Act exposure: 0/25

Technical capabilities:

Cost comparison:

BorgBackup — Deduplicating Archiver

What it is: BorgBackup (Borg) is an open-source deduplicating backup program. It is developed by a distributed team of European and international contributors through the Borg Collective, with no US corporate entity controlling development.

CLOUD Act exposure: 0/25

Technical capabilities:

Sample Borgmatic configuration for EU deployment:

location:
  source_directories:
    - /var/www
    - /var/lib/postgresql
  repositories:
    - path: ssh://backup@hetzner-storage-box/./backups
      label: hetzner-storage

retention:
  keep_daily: 7
  keep_weekly: 4
  keep_monthly: 6

encryption_passphrase: "your-strong-passphrase"

hooks:
  postgresql_databases:
    - name: all
      hostname: localhost

Cost: Borg/Borgmatic is free. Hetzner Storage Box (EU, 0/25): from €3.94/month for 1TB. Hetzner Object Storage: €0.0059/GB/month (€5.90/TB). Total cost for 10TB EU backup: ~€59/month = €708/year vs €12,000–€18,000/year for Acronis.

Restic — Fast, Encrypted Backup

What it is: Restic is a modern backup program written in Go, designed for simplicity, speed, and security. Like Borg, it has no US corporate entity.

CLOUD Act exposure: 0/25

Technical capabilities:

Comparison to Borg: Restic uses S3-compatible object storage backends more naturally than Borg (which is SSH-centric). For teams already using S3-compatible EU object storage (Hetzner, Scaleway, OVH), Restic is often simpler to integrate.

GDPR Compliance Comparison Table

VendorCLOUD Act ScoreJurisdictionData at RestData in Transit RiskGDPR Art.44 Status
Acronis AG14/25Swiss AG + US subsUS regions availableTelemetry → US by default⚠️ Conditional (requires significant hardening)
Bareos GmbH0/25GermanySelf-hosted, EU onlyNone (self-hosted)✅ Compliant
SEP sesam0/25GermanySelf-hosted, EU onlyNone (self-hosted)✅ Compliant
BorgBackup0/25Open Source, no entitySelf-hosted, EU onlyNone (SSH encrypted)✅ Compliant
Restic0/25Open Source, no entitySelf-hosted, EU onlyNone (encrypted)✅ Compliant
Proxmox BS0/25AustriaSelf-hosted, EU onlyNone (self-hosted)✅ Compliant

Migration Guide: Acronis to Bareos

For organisations currently running Acronis Cyber Protect and seeking to migrate to a GDPR-compliant alternative, Bareos provides the most feature-equivalent path for enterprise environments.

Phase 1: Assessment (Weeks 1–2)

Inventory current Acronis usage:

Infrastructure requirements for Bareos:

Phase 2: Parallel Deployment (Weeks 3–6)

Deploy Bareos alongside Acronis. Configure Bareos to protect a subset of systems while Acronis continues to protect the full environment.

Installation on Debian/Ubuntu:

# Add Bareos repository
wget -q https://download.bareos.org/bareos/release/latest/Debian_12/Release.key -O- | gpg --dearmor > /usr/share/keyrings/bareos-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/bareos-keyring.gpg] https://download.bareos.org/bareos/release/latest/Debian_12/ /" > /etc/apt/sources.list.d/bareos.list

# Install Director, Storage, WebUI, and File Daemon
apt-get update
apt-get install bareos bareos-database-postgresql bareos-webui

# Initialize database
su -s /bin/bash postgres -c "/usr/lib/bareos/scripts/create_bareos_database"
su -s /bin/bash postgres -c "/usr/lib/bareos/scripts/make_bareos_tables"
su -s /bin/bash postgres -c "/usr/lib/bareos/scripts/grant_bareos_privileges"

# Start Bareos services
systemctl enable --now bareos-dir bareos-sd bareos-fd

Configure your first backup job:

# /etc/bareos/bareos-dir.d/job/backup-web-servers.conf
Job {
  Name = "backup-web-servers"
  JobDefs = "DefaultJob"
  Client = webserver01-fd
  FileSet = "LinuxAll"
  Schedule = "WeeklyCycle"
  Storage = EU-Storage
  Pool = Full
  Full Backup Pool = Full
  Incremental Backup Pool = Incremental
  Differential Backup Pool = Differential
  Write Bootstrap = "/var/lib/bareos/%c.bsr"
  Priority = 10
}

Phase 3: Validation and Cutover (Weeks 7–10)

Restore testing checklist:

Cutover:

Phase 4: Compliance Documentation (Week 11–12)

Under GDPR Article 30 (Records of Processing Activities), update your ROPA to reflect:

Update your Data Protection Impact Assessment (DPIA) if backup processing was identified as high-risk under Article 35.

Cost Analysis: Acronis vs EU Alternatives

50-Endpoint Environment (Typical Mid-Market Enterprise)

SolutionYear 1 CostYear 3 TCOCLOUD Act Score
Acronis Cyber Protect Cloud€6,000–€12,000€18,000–€36,00014/25
Bareos Subscription + Hetzner€8,000–€15,000€18,000–€30,0000/25
SEP sesam (perpetual)€15,000–€25,000€20,000–€32,0000/25
BorgBackup + Hetzner Storage Box€500–€2,000€1,500–€6,0000/25

Key finding: Borg/Restic self-hosted on EU infrastructure provides 70–90% cost reduction vs Acronis cloud for organisations with technical capacity to manage it. Bareos and SEP sesam offer comparable 3-year TCO to Acronis while eliminating all CLOUD Act exposure.

Compliance Cost Avoided

For organisations subject to GDPR enforcement:

A 14/25 CLOUD Act score represents real regulatory risk. The EDPB has issued enforcement guidance requiring organisations to assess transfer risks under Article 32 even when SCCs are in place. Acronis's US subsidiary structure means SCCs alone are insufficient.

Decision Framework: When to Choose Each Solution

Choose Bareos when:

Choose SEP sesam when:

Choose BorgBackup/Restic when:

Stay with Acronis if:

For most EU organisations handling personal data of EU data subjects, the residual CLOUD Act risk from Acronis's US subsidiary and federal contractor entity cannot be fully mitigated through contract alone. The Schrems II ruling is explicit: surveillance law obligations imposed on US entities cannot be overridden by DPAs or SCCs.

Conclusion

Acronis's Swiss headquarters provides a genuine but partial shield. The US subsidiary (Acronis Inc., Burlington MA), the federal contractor entity (Acronis SCS LLC, Woburn MA), and the Goldman Sachs investment all create CLOUD Act pathways that cannot be eliminated by contractual agreement. Acronis scores 14/25 on our CLOUD Act exposure methodology — comparable to Veeam, and significantly higher than EU-native alternatives.

For EU organisations subject to GDPR — particularly those in regulated sectors (healthcare, finance, public sector) or those handling sensitive personal data — Bareos, SEP sesam, BorgBackup, and Restic offer equivalent functionality with 0/25 CLOUD Act exposure. The 3-year TCO is comparable to Acronis for enterprise deployments, and the regulatory risk reduction is substantial.

Next in the EU Backup & Recovery Series: Commvault EU Alternative 2026 — New Jersey, NASDAQ-listed, CLOUD Act exposure analysis for large enterprise backup.

Methodology: Our 25-point CLOUD Act exposure score assesses five dimensions — corporate jurisdiction (5pt), data flows (5pt), investor/PE structure (5pt), CLOUD Act direct applicability (5pt), and intelligence/surveillance links (5pt). 0/25 = full EU sovereignty. 25/25 = maximum US surveillance exposure. Scores above 10/25 warrant DPIA review under GDPR Article 35.

EU-Native Hosting

Ready to move to EU-sovereign infrastructure?

sota.io is a German-hosted PaaS — no CLOUD Act exposure, no US jurisdiction, full GDPR compliance by design. Deploy your first app in minutes.

Start free — no credit cardView pricing