Rubrik EU Alternative 2026: CLOUD Act Risk, GDPR Compliance, and Zero Trust Contradictions

Post #4 in the sota.io EU Backup & Recovery Series

Rubrik markets itself as the leader in "Zero Trust Data Security." The tagline implies that no entity — not even the backup vendor — can access your data. It is a compelling security narrative. But it is legally incomplete.

Rubrik Inc. is a Delaware corporation headquartered in Palo Alto, California. It listed on the New York Stock Exchange in April 2024 under ticker RBRK. As a domestic US company, it falls squarely under the Clarifying Lawful Overseas Use of Data Act — the CLOUD Act — which grants US law enforcement the authority to compel production of data from US companies regardless of where that data is stored. The "zero trust" architecture governs unauthorized attackers. It does not govern the US government.

This post scores Rubrik on 25 CLOUD Act risk indicators, identifies the five highest GDPR exposure points in Rubrik's product architecture, and presents EU-native backup alternatives that achieve genuine data sovereignty — not just marketing sovereignty.

Rubrik Inc.: Legal Entity Analysis

Full legal name: Rubrik Inc. Incorporation: Delaware, United States Headquarters: 3495 Deer Creek Road, Palo Alto, California 94304 Stock exchange: NYSE: RBRK (IPO April 25, 2024, raised $752M) Revenue (FY2025): $1.06 billion (reported February 2025) Employees: ~4,000 globally

Rubrik was founded in 2014 by Bipul Sinha, Arvind Nandakumar, Arvind Jain, and Soham Mazumdar — all alumni of Google and Facebook. Its investor base includes Microsoft (strategic partner and equity holder), Lightspeed Venture Partners, IVP, Greylock Partners, and Khosla Ventures.

The Microsoft relationship deserves particular attention. In 2022, Microsoft announced an $800 million financing facility for Rubrik — a combination of debt and equity — alongside a deep technical integration with Microsoft Sentinel, Microsoft Defender, and Azure Blob storage. This integration means Rubrik's threat intelligence data flows through Microsoft's US-hosted security infrastructure, creating a second jurisdictional layer beyond Rubrik's own.

CLOUD Act Risk Score: 18/25

The 25-point CLOUD Act risk matrix evaluates legal entity structure, data architecture, government relationships, financial arrangements, and product design choices. Rubrik scores 18 out of 25 risk indicators:

Total: 18/25 (same tier as Commvault's 17/25 and Ansible/IBM's 20/25)

The Zero Trust Contradiction

Rubrik's security narrative is built around three pillars: immutable backups, access controls, and threat detection. These are meaningful protections against ransomware operators, rogue insiders, and cyberattacks. The "zero trust" label is technically accurate for unauthorized access scenarios.

But CLOUD Act compulsion is not an unauthorized access scenario. It is a lawful order. And Rubrik's own terms of service acknowledge it:

"Rubrik may disclose Customer Data if required to do so by law or in the good faith belief that such action is necessary to comply with applicable laws or respond to lawful requests by public authorities, including national security or law enforcement requests."

This clause is standard for US companies. Its presence does not indicate malice. But for European organizations subject to GDPR Chapter V transfer restrictions, it is the critical passage. The CLOUD Act creates a legal pathway for US authorities to access Rubrik's systems — including the SaaS control plane that processes backup metadata for all customers.

What the GDPR Requires

GDPR Article 44 prohibits transfers of personal data to third countries unless an appropriate safeguard is in place. Article 28 requires that data processors only process data on documented instructions. Article 32 mandates appropriate technical and organizational measures against unauthorized processing.

When Rubrik's SaaS control plane — which processes backup metadata including file names, timestamps, directory structures, user identifiers, and access logs — is hosted in the United States, every interaction with that plane constitutes a data transfer under GDPR. The appropriate safeguard (Standard Contractual Clauses under Commission Decision 2021/914/EU) does not override a CLOUD Act order. As the European Court of Justice held in Schrems II (C-311/18), US law must provide an essentially equivalent level of protection. FISA §702 and the CLOUD Act do not meet that standard for most data categories.

Five Highest GDPR Exposure Points in Rubrik's Architecture

1. Rubrik Security Cloud — SaaS Control Plane in US Jurisdiction

Rubrik Security Cloud (RSC) is the management plane for all Rubrik deployments. Even organizations running Rubrik's on-premises appliances (CDM — Cloud Data Management) must connect to RSC for:

• License validation and feature activation
• Rubrik Radar threat detection analysis
• Global policy management across clusters
• Compliance reporting dashboards
• Data classification and sensitive data discovery

RSC is operated from Rubrik's US cloud infrastructure. Backup metadata — including the structure of your filesystem, user account names, access timestamps, file type distributions, and anomaly signals — flows to RSC continuously. Under GDPR, this metadata constitutes personal data when it relates to identifiable individuals (their files, their access patterns, their organizational roles).

GDPR exposure: Art.44 (transfers), Art.28 (processor instructions), Art.13/14 (transparency) Risk level: High — no opt-out from RSC connectivity in standard deployment

2. Rubrik Radar — AI Threat Detection Sends Anomaly Data to US

Rubrik Radar is the AI-powered ransomware detection feature. It analyzes backup snapshots to identify:

• Entropy spikes in file content (indicating encryption)
• Mass file deletion or renaming patterns
• Changes in file extension distributions
• Access pattern anomalies by user account

The analysis occurs in Rubrik Security Cloud. Raw backup content stays on-premises in the CDM appliance, but the behavioral signals — which user accessed which files, when deletions occurred, which directories were affected — are transmitted to RSC for Radar's machine learning models.

These behavioral signals are personal data. They identify individuals by their access patterns. Sending them to a US-hosted AI system requires a GDPR Art.44 transfer mechanism, and that mechanism must survive a CLOUD Act compulsion analysis.

GDPR exposure: Art.44 (AI analytics transfer), Art.22 (automated decision-making), Art.32 (security processing) Risk level: High — Radar is enabled by default in RSC-connected deployments

3. FBI and CISA Partnerships — Law Enforcement Integration Risk

Rubrik is a member of the Cyber Threat Alliance (CTA), a US-based nonprofit that facilitates threat intelligence sharing among cybersecurity vendors, including with US federal law enforcement. Rubrik has also publicly disclosed participation in CISA's Joint Cyber Defense Collaborative (JCDC).

These memberships create a structural relationship between Rubrik and US law enforcement agencies. In ransomware incidents — which are precisely the scenarios where Rubrik is most heavily used — Rubrik may share threat intelligence with FBI Cyber Division, CISA, or JCDC partners.

For European organizations in critical infrastructure sectors (utilities, healthcare, banking, transport), this creates a direct conflict with NIS2 Directive Article 32 obligations to control incident reporting channels. NIS2 requires organizations to report significant incidents to national CSIRTs. If Rubrik's JCDC integration creates a parallel reporting pathway to US federal agencies, this may conflict with EU member state sovereignty over critical infrastructure incident data.

GDPR exposure: Art.44 (transfers to US agencies), potential conflict with NIS2 Art.32 Risk level: Medium-High — specifically elevated for critical infrastructure operators

4. Microsoft Strategic Partnership — Second Jurisdictional Layer

Rubrik's deep integration with Microsoft creates compounded jurisdictional exposure:

• Microsoft Sentinel integration: Rubrik sends security events and backup anomalies to Microsoft Sentinel (US-hosted SIEM) — a second US-jurisdiction data processor
• Azure Blob archival: CloudOut and Cloud Archival features store backup copies to Azure blob storage, with data processed by Microsoft's US-headquartered entity
• Microsoft Purview integration: Data classification results from Rubrik feed into Microsoft Purview (US-hosted compliance platform)
• Defender for Cloud integration: Rubrik threat signals appear in Microsoft Defender dashboards

Each integration point is a separate GDPR Art.28 sub-processor relationship. Organizations that have carefully documented their Rubrik DPA may overlook the Microsoft sub-processor chain that Rubrik's integrations activate.

GDPR exposure: Art.28(2) (sub-processors), Art.44 (multi-layer US transfers) Risk level: Medium-High — affects all organizations using RSC's native integrations

5. Ransomware Recovery — Investigation Data and Chain of Custody

Rubrik's ransomware recovery workflow, branded as Rubrik Cyber Recovery, includes a forensic investigation phase where backup snapshots are used to reconstruct the timeline of an attack. This generates:

• File-level provenance records
• User account activity logs during the incident window
• Malware signature data
• Affected system inventory

Rubrik recommends — and its professional services teams facilitate — sharing this forensic data with law enforcement. For US customers, this means FBI coordination. For European customers, the appropriate channel is national police cyber units (BSI/BKA in Germany, ANSSI in France, NCSC in the UK). But Rubrik's forensic workflows were designed primarily for the US law enforcement ecosystem.

European organizations conducting ransomware investigations with Rubrik's assistance may inadvertently transfer forensic data containing personal information (employee account names, file access records, communication metadata) to US-hosted Rubrik infrastructure during the investigation phase, when GDPR compliance review capacity is typically lowest.

GDPR exposure: Art.44 (forensic data transfers), Art.9 (criminal records data if employee accounts implicated), Art.32 (incident response data security) Risk level: Medium — elevated during incident response when compliance attention is lowest

EU-Native Backup and Data Protection Alternatives

The following alternatives score 0/25 on the CLOUD Act risk matrix — meaning no US jurisdiction exposure — and can serve as Rubrik replacements for European organizations.

Bareos: Open Source Enterprise Backup from Germany

Legal entity: Bareos GmbH & Co. KG, Köln (Cologne), Germany CLOUD Act score: 0/25 — German GmbH & Co. KG, no US parent, no US investors GDPR status: Data processor under German law (BDSG + GDPR Art.4(8))

Bareos (Backup Archiving Recovery Open Sourced) is a fork of Bacula maintained by a German company. It provides enterprise backup for Linux, Windows, and macOS environments.

Key capabilities:

• File-level backup with deduplication
• Tape library and cloud storage support (S3-compatible, including Hetzner Object Storage)
• Web interface (WebUI) for management
• TLS encryption in transit, AES-256 at rest
• LDAP/AD integration for access controls
• Plugin architecture for database backups (PostgreSQL, MySQL, Oracle)

Deployment: Self-hosted only — Bareos runs entirely on your infrastructure. No SaaS control plane, no cloud analytics, no phone-home telemetry. The backup catalog (metadata database) stays on your PostgreSQL or MariaDB instance.

Migration from Rubrik: Rubrik exports backup catalogs in standard formats. Bareos can ingest file-level backup data. Application-consistent backups (VM snapshots, database dumps) require reconfiguration of Bareos plugins.

Licensing: AGPL v3 — fully open source. Commercial support available from Bareos GmbH.

Cost example (1PB backup environment):

• Bareos software: €0 (open source)
• Storage: Hetzner Object Storage €6.44/TB/month → €6,440/month for 1PB
• 3 Bareos Director servers (Hetzner AX102, 128GB RAM): €316/month total
• Commercial support contract: €2,000-5,000/month (depending on SLA)
• Total: ~€8,756-€11,756/month
• Rubrik comparison: Rubrik Security Cloud licensing starts at ~$60,000/year for 50TB → $120/TB/year = $120,000/month for 1PB

Proxmox Backup Server: Austrian Open Source for VM Backup

Legal entity: Proxmox Server Solutions GmbH, Wien (Vienna), Austria CLOUD Act score: 0/25 — Austrian GmbH, EU jurisdiction, no US parent GDPR status: Data processor under Austrian law (DSG + GDPR)

Proxmox Backup Server (PBS) is purpose-built for VM and container backup, with deep integration into Proxmox VE and support for QEMU/KVM environments.

Key capabilities:

• Incremental, deduplicated backups for VMs and LXC containers
• Chunk-based deduplication with client-side verification
• Built-in encryption (AES-256-GCM) with user-managed keys
• REST API for automation
• Proxmox VE native integration (scheduler, retention policies)
• Tape backup support for long-term archival

Deployment: Self-hosted. PBS runs on your hardware. No external connectivity required. The web UI, backup catalog, and all data stay on-premises.

Migration from Rubrik: PBS primarily covers VM-level backup. For Rubrik customers using CDM for VM protection on VMware or Proxmox VE environments, PBS is a direct functional replacement. File-level backup of Windows servers requires additional tooling (e.g., Bareos + PBS combination).

Cost example (50TB VM backup environment):

• PBS software: €0 (open source)
• Hetzner AX52 backup server (8-core, 64GB RAM, 2×1.92TB NVMe): €105/month
• Additional storage nodes: varies by capacity
• Total: from €105/month for small deployments

Restic + BorgBackup: Open Source File-Level Backup

Restic: Go, MIT license, client-side AES-256 encryption, content-addressable storage BorgBackup (Borg): Python/C, BSD license, deduplication, compression, encryption, pruning

Both tools run entirely on your infrastructure. Backup repositories can be stored on:

• Hetzner Storage Box (EU-hosted, SFTP-accessible)
• Hetzner Object Storage (S3-compatible, Frankfurt/Helsinki)
• Any SFTP-accessible EU server
• Local NAS (ZFS, ext4)

CLOUD Act score: 0/25 — both are open-source projects with no corporate entity

GDPR advantages:

• No SaaS control plane
• No telemetry
• Encryption keys are exclusively yours
• Backup repository can be air-gapped

Limitations vs. Rubrik:

• No native ransomware detection (use Wazuh or OpenEDR separately)
• No GUI management layer (add Resticker or BorgMatic for scheduling)
• No application-consistent VM backup (combine with Proxmox PBS for VMs)

Cost (100TB backup):

• Hetzner Storage Box 10TB × 10 instances: €107/month total
• Or Hetzner Object Storage 100TB: €644/month
• Restic/Borg software: €0

Amanda: The Original Open Source Enterprise Backup

Legal entity: Amanda is maintained by the open-source community, with ZManda (Zmanda Inc., Sunnyvale CA) offering commercial support Note: Amanda (Advanced Maryland Automatic Network Disk Archiver) is open source under the Amanda license. The upstream project has no mandatory SaaS component. ZManda's commercial support is a US company but is optional — organizations can run Amanda community edition with EU-based support contracts.

Amanda handles:

• Tape and disk-to-disk backup
• Large-scale file system backup
• Integration with Kerberos authentication
• Backup encryption with GPG

Rubrik to EU Alternative: Migration Decision Framework

Rubrik GDPR Risk Assessment by Data Category

Not all data in a Rubrik deployment is equally sensitive. Here is a risk-stratified view:

The backup catalog deserves particular attention. Rubrik Security Cloud stores the complete index of all backed-up files across all your protected systems. This catalog includes file names, sizes, modification timestamps, directory paths, and user ownership attributes. Even without the file contents, this metadata constitutes personal data under GDPR when it relates to identifiable employees (their work product, their activity patterns, their organizational roles).

GDPR Compliance Checklist for Rubrik Deployments

For organizations that must continue using Rubrik during a migration transition, these mitigations reduce (but do not eliminate) GDPR exposure:

• Execute Rubrik's Data Processing Agreement (DPA) under GDPR Art.28
• Review Rubrik's sub-processor list — include Microsoft as sub-processor in your ROPA
• Disable CloudOut and Cloud Archival if Azure/AWS storage is not required
• Document legal basis for RSC metadata transfers under GDPR Art.46 (SCCs)
• Conduct Transfer Impact Assessment (TIA) under Schrems II guidance for US RSC connectivity
• Disable Rubrik Radar integration with Microsoft Sentinel if Azure-hosted SIEM is not approved
• Configure Rubrik's air-gap feature for most sensitive data categories (HR, financial, medical)
• Establish incident response protocol that routes forensic data to EU-based law enforcement only
• Review JCDC membership implications with legal counsel for critical infrastructure operators

The Rubrik Zero Trust Marketing vs. Legal Reality

Rubrik's "Zero Trust Data Security" brand promise is worth examining precisely:

What Zero Trust means in Rubrik's architecture:

• Immutable backup snapshots that ransomware cannot modify after creation
• Multi-factor authentication for Rubrik Security Cloud access
• Role-based access controls at the file and backup level
• Encrypted data in transit and at rest using keys managed by Rubrik

What Zero Trust does not protect against:

• US government CLOUD Act orders compelling Rubrik to produce backup catalog data
• FISA §702 collection from Rubrik's cloud infrastructure if foreign intelligence targets are involved
• NSL (National Security Letters) requiring non-disclosure of data production
• US court subpoenas in civil litigation seeking competitor backup data

The zero trust model assumes that "trust" refers to network segments and access credentials. It does not address governmental compulsion, which operates outside the authentication layer entirely. A CLOUD Act order does not need your Rubrik password.

This distinction matters for European organizations that have adopted Rubrik specifically for its security-forward positioning. The marketing addresses a real threat (ransomware). It does not address the jurisdictional threat that GDPR was designed to manage.

NIS2 Directive Implications

For operators of essential services under NIS2 (Directive 2022/2555/EU) — energy, transport, banking, health, digital infrastructure — Rubrik creates specific compliance considerations:

NIS2 Article 21 requires appropriate technical and organizational measures for data backup, disaster recovery, and supply chain security. Using a US-jurisdiction backup vendor satisfies the technical requirement (backups exist) but may not satisfy the organizational requirement (control over backup data).

NIS2 Article 32 requires incident reporting to national competent authorities and CSIRTs. Rubrik's JCDC integration potentially creates a parallel reporting channel to US federal agencies. NIS2-obligated entities should review whether Rubrik's incident response workflows comply with member-state-specific reporting requirements.

NIS2 Article 23 requires significant incident notification within 24 hours. During an active ransomware incident when Rubrik's recovery tools are in use, ensuring GDPR Art.44 compliance for forensic data transfers to Rubrik's US infrastructure becomes operationally challenging.

The practical guidance: NIS2-obligated entities should use Rubrik only with a documented legal basis for RSC connectivity, with incident response protocols that explicitly separate Rubrik's recovery tools from any data export to US-hosted infrastructure, and with contractual provisions that prohibit Rubrik from sharing incident data with non-EU authorities without prior written consent.

Migration Timeline: Rubrik to EU-Sovereign Backup

Phase 1 (Weeks 1-4): Inventory and parallel deployment

• Document all Rubrik-protected workloads (VMs, file servers, databases, applications)
• Deploy Bareos Director and Storage Daemon on EU-hosted infrastructure
• Deploy Proxmox Backup Server if VM protection is a primary requirement
• Configure Hetzner Storage Box or Object Storage as backup destination
• Begin parallel backup of non-sensitive workloads

Phase 2 (Weeks 5-8): Data category migration

• Migrate highest-risk data categories first (HR, financial, customer databases)
• Validate backup integrity and test restoration workflows
• Configure Bareos deduplication and compression for storage efficiency
• Set up BorgBackup for file-level backup of Linux servers (complement to Bareos)
• Document new DPA with Hetzner as sub-processor

Phase 3 (Weeks 9-12): Rubrik deprecation

• Complete migration of all workloads to EU-hosted backup infrastructure
• Terminate RSC connectivity (disable cloud policy sync)
• Validate air-gap backup for most sensitive data (HR, board communications)
• Update ROPA and sub-processor registry to remove Rubrik and Microsoft
• Notify supervisory authority if previous Rubrik deployment required Art.36 consultation

Post-migration: Ransomware detection gap Rubrik Radar provides threat detection capabilities that open-source backup tools do not natively include. EU-native alternatives for ransomware detection:

• Wazuh (Wazuh Inc., Madrid, Spain) — open source SIEM with file integrity monitoring
• OpenEDR (Comodo, open source) — endpoint detection and response
• OSSEC (open source) — host-based intrusion detection

Key Takeaways

1. Rubrik Inc. is a Delaware corporation — it is subject to CLOUD Act compulsion for any data it possesses or controls, regardless of physical storage location.

2. Rubrik Security Cloud is the GDPR exposure point — even organizations running on-premises CDM appliances expose backup metadata (catalog, anomaly signals, compliance reports) through mandatory RSC connectivity.

3. "Zero Trust" does not mean "Zero CLOUD Act" — the security architecture prevents unauthorized access. It does not prevent lawful US government access through CLOUD Act orders.

4. The Microsoft integration compounds risk — Rubrik's strategic partnership with Microsoft creates a second US-jurisdiction layer for organizations using Sentinel, Azure Blob archival, or Purview integrations.

5. EU alternatives exist at every tier — Bareos (enterprise-grade, German company), Proxmox Backup Server (Austrian company, VM-focused), and Restic/BorgBackup (open source, air-gap capable) cover the full range of backup requirements without US jurisdiction exposure.

6. NIS2-obligated entities face specific risks — the JCDC integration and FBI partnership create compliance questions for critical infrastructure operators that go beyond standard GDPR analysis.

This analysis is legal information, not legal advice. Organizations subject to GDPR should consult qualified data protection counsel for jurisdiction-specific guidance. CLOUD Act risk scores are based on publicly available legal entity and product architecture information as of May 2026.

This is Post #4 of 5 in the sota.io EU Backup & Recovery Series. Post #5 covers Cohesity Inc. (San Jose CA) and the EU Backup & Recovery Comparison Finale.

sota.io is an EU-native managed PaaS — no US parent company, no CLOUD Act exposure, hosted on Hetzner Germany. Deploy your first app free →