Skip to content
Book a demo

Google Cloud backup

Google Cloud backup Google can't reach

Google runs your cloud. Mindtime runs the copy Google can't reach: immutable copies of your Google Cloud workloads in Dutch and German data centres, independent of Google's control plane and jurisdiction.

Book a consultation call Book a demo
Works with
Backup and DR Service
Storage
Immutable, WORM
Data centres
NL · DE
Jurisdiction
EU only

In short

What is Google Cloud backup?

Sovereign Google Cloud backup is a second, independent copy of your GCP data, held outside Google by a European operator. Keep Google's Backup and DR Service for fast rollbacks inside GCP; Mindtime is the immutable copy in the Netherlands and Germany for when that first copy is out of reach.

What we back up
Compute Engine, Cloud Storage, Cloud SQL, AlloyDB, Spanner, Firestore, BigQuery, GKE and more
Where it is stored
Mindtime data centres in the Netherlands and Germany, outside GCP
How it is protected
WORM-enforced and air-gapped by default, with identity separate from Google Cloud IAM
Encryption keys
Customer-held or EU-HSM keys

The risk

Backup and DR still lives inside Google

Backup vaults, snapshots and cross-region replication are run by Google, under the same US legal framework as Google itself.

  1. IAM

    One identity plane

    Your backup vault, production project and admins share one IAM perimeter. One compromised service account can reach both.

  2. CLOUD Act

    Google is a US company

    Storing data in europe-west3 doesn't move Google out of US jurisdiction.

  3. Regions

    A second region is still Google

    Regional redundancy protects against a data-centre failure, not against identity compromise, account takedown or legal compulsion.

What's covered

Every Google Cloud service your auditors care about

Compute, data, containers and the VMware estate on top of Google Cloud VMware Engine.

  • GCE

    Compute and storage

    • Compute Engine and persistent disks
    • Filestore
    • Cloud Storage, all classes
    • Google Cloud VMware Engine

  • DB

    Managed databases

    • Cloud SQL: PostgreSQL, MySQL, SQL Server
    • AlloyDB and Spanner
    • Firestore, Bigtable and BigQuery
    • Point-in-time recovery

  • K8s

    Kubernetes and apps

    • GKE persistent volumes
    • Stateful workloads and Anthos clusters
    • SAP on Google Cloud
    • Application-consistent snapshots

What's included

How Mindtime protects it

Standard with every Mindtime backup, on top of the 3-2-1-1-0 rule and immutable storage in the Netherlands and Germany.

  • Immutable by default

    WORM-enforced storage. Backups can't be changed or deleted during retention.

  • Separate control plane

    Backups sit behind credentials and an identity plane that are separate from Google Cloud IAM, so one compromised admin can't reach both.

  • Your keys

    Bring your own keys or use an EU-based HSM. Your data is cryptographically yours.

  • EU end to end

    EU legal entity, EU staff and EU sub-processors, with no US parent company.

  • Verified recoveries

    Quarterly restore drills with signed reports for your auditors.

  • Evidence for regulators

    Evidence for DORA and NIS2 audits, plus a GDPR Data Processing Agreement.

The difference

Google Cloud Backup and DR vs. Mindtime

Native tools are a good first copy. An independent backup is the one you can still reach when the first copy is gone.

Google Cloud Backup and DR vs. Mindtime
CapabilityBackup and DR (native)Mindtime sovereign backup
Legal jurisdictionUS, CLOUD Act appliesEU only: contract, operator and storage
Storage locationGCP-managed backup vaultsMindtime data centres in NL and DE, outside GCP
Identity planeGoogle Cloud IAMIndependent, separate from GCP
ImmutabilityVault retention and backup locksWORM-enforced, air-gapped by default
Encryption keysGoogle-managed or CMEK in Cloud KMSCustomer-held or EU-HSM keys
Works with Backup and DR—Yes: we complement it, we don't replace it

How it works

Up and running in three steps

No rip-and-replace and no long project. Our team helps you at every step.

  1. 01

    Consultation and scoping

    A 45-minute call about your GCP organisation, critical workloads, recovery targets and regulators such as DORA and NIS2.

  2. 02

    Architecture and deployment

    We design the sovereign vault, define immutable retention and deploy with least-privilege service accounts and Workload Identity Federation.

  3. 03

    Verified recoveries

    Quarterly restore drills, signed reports for your auditors, and a named European engineer on your account.

FAQ

Common questions

Do we have to stop using Backup and DR?

No. Keep it for fast rollbacks inside GCP. Mindtime is the sovereign, immutable copy held outside Google's control plane and jurisdiction.

Isn't a second GCP region enough?

No. A second region is still Google: same company, same US jurisdiction, same IAM plane.

What about Google's sovereign cloud offerings in Europe?

Partner-operated sovereign clouds reduce operational exposure, but they don't remove US-parent obligations everywhere. An independent copy of record needs an operator that is European end to end.

How fast can we recover?

We design to your recovery time objective. For tier-1 workloads we commit to recovery windows in minutes to hours, proven in quarterly drills.

Keep reading

Guides and related workloads

Related guides

All backup guides

Related workloads

  1. 01Google Workspace backupGoogle Workspace backup, hosted in the EU.
  2. 02AWS backupAWS backup outside US jurisdiction.
  3. 03Azure backupAzure backup outside the Microsoft control plane.
  4. ↑Backup as a ServiceThe full platform: every workload, the 3-2-1-1-0 rule and how Mindtime runs it for you.