Backblaze Privacy & Security Review: Is It Safe for Your Data?

Backblaze Privacy & Security Review

Backblaze is a secure cloud backup service with AES-256 encryption in transit and at rest, but it holds your encryption key, meaning it is not zero-knowledge. For maximum privacy, use client-side encryption tools like Cryptomator.

What Backblaze Offers: Strengths & Weaknesses

Strengths

• Unlimited backup for one price
• Strong encryption (TLS 1.2+ for transfer, AES-256 at rest)
• Two-factor authentication (2FA) available
• Transparent privacy policy and security practices
• B2 object storage with flexible access controls

Weaknesses

• Not zero-knowledge: Backblaze holds your encryption key
• Data centers in US and EU, subject to CLOUD Act
• Limited control over data location (no Swiss option)
• File scanning for malware (but not for AI training)
• Telemetry data collected (can be opted out)

Privacy & ToS Analysis

Encryption: Backblaze uses TLS for data in transit and AES-256 for data at rest. However, they manage the encryption keys, so they can technically access your files if required by law. No zero-knowledge or E2EE unless you add your own encryption layer.

Data Centers: Located in the US (California, Arizona) and EU (Netherlands). US data centers are subject to the CLOUD Act, which may allow US authorities to request data. EU data centers offer GDPR protections but still fall under Backblaze's US jurisdiction.

File Scanning: Backblaze scans files for malware and may share threat data with partners. They do not scan for AI training purposes.

Telemetry: The client collects usage data; you can opt out in settings.

CLOUD Act: As a US company, Backblaze must comply with US law, including the CLOUD Act, which can compel disclosure of data stored in US data centers.

How to Protect Your Privacy on Backblaze

1. Enable 2FA: Go to Account Settings > Security > Two-Factor Authentication and set up via authenticator app.
2. Use Client-Side Encryption: Encrypt files before upload using Cryptomator (for B2) or Rclone with crypt remote. This ensures zero-knowledge.
3. Opt Out of Telemetry: In the Backblaze client, go to Settings > Performance > uncheck "Send usage statistics."
4. Secure Sharing: Use B2's signed URLs with expiration dates. Never share private keys.
5. Choose EU Data Center: When setting up B2, select the Netherlands region for GDPR protections.

CCPA & California Privacy Rights

Backblaze complies with the California CCPA and CPRA. Under these laws, California residents have the right to know what personal data is collected, request deletion, and opt out of sale of data. Backblaze does not sell personal data. However, compared to the US model, the CCPA provides more transparency but less control than GDPR. Backblaze's privacy policy details how to exercise these rights.

FAQ

Is Backblaze zero-knowledge?

No. Backblaze holds your encryption key, so they can technically access your files. Use client-side encryption for true zero-knowledge.

Does Backblaze scan my files for AI training?

No. Backblaze scans for malware only, not for AI training. Your files are not used to train models.

Can I choose where my data is stored?

Yes, for B2 you can select US West, US East, or EU (Netherlands). For personal backup, data is stored in US data centers by default.