In this guide · 8 sections
Short answer
An immutable backup can't be edited or deleted until its lock expires, so ransomware that steals your admin login still can't wipe it. Use object lock on cloud storage such as Backblaze B2 or Amazon S3, or immutable snapshots on a Synology NAS, kept on separate credentials from your main systems.
What 'immutable' means for a backup
Immutable means write once, then read only, for a fixed period. Until the lock date, the storage refuses any request to overwrite or delete the file, including requests from your own admin account. After the date, normal retention rules apply and old copies can be cleaned up.
| Backup type | Can ransomware with your admin login delete it? | Notes |
|---|---|---|
| Files synced to OneDrive, Google Drive or Dropbox | Yes, the sync spreads encrypted files | Version history helps, but it is not a backup |
| USB drive left plugged in | Yes | Safe only when unplugged and stored away |
| Ordinary cloud or NAS backup | Usually yes, if the backup login is stolen | Most common gap in small offices |
| Cloud storage with object lock (compliance mode) | No, until the lock date | Protects even against stolen root credentials |
| Synology immutable snapshot | No, until the protection period ends | Local copy, so pair it with an off-site one |
Immutability is one part of the wider rule of keeping several copies in different places; our 3-2-1 backup rule guide explains how it fits.
Object lock in cloud storage
Object lock is the cloud version. Backblaze's Object Lock documentation says it prevents a file from being changed or deleted until a given date, to protect against threats like ransomware, and that it works the same way as Amazon S3's object lock from a functional point of view.
Governance mode
- Retention can be changed or removed by keys with special permissions
- Useful while you are testing
- Weaker if those keys are stolen
Best for: Trial runs and short-term locks.
Compliance mode
For ransomware protection- Nobody can remove the retention, only extend it
- Protects against stolen admin keys
- Mistakes can't be undone
Best for: Production backups once settings are proven.
Your backup software needs to support object lock, so that it sets the lock on each upload and handles old versions correctly. Check the backup tool's documentation for object lock or immutability support before you buy storage.
Immutable snapshots on a Synology NAS
If your files live on a Synology NAS, its Snapshot Replication package can lock snapshots on the NAS itself. Synology's snapshot help page says that with 'Enable immutable snapshots' selected, a snapshot cannot be removed by any means during the protection period, and recommends a period of 7 to 14 days.
- The setting can't be changed until the system clears it at the end of the period.
- A shared folder or LUN with immutable snapshots can't be deleted until the protection period ends.
- If you select several snapshots and some are immutable, the Delete button is disabled.
- Snapshots use space on the same NAS, so a longer period needs more free capacity.
Snapshots protect against ransomware that encrypts files over the network. They don't protect against the NAS itself failing, a fire or theft, so you still need an off-site copy, ideally with object lock as well.
What immutable backups cost
For a small office the storage cost is modest; the bigger cost is the backup software and the time to set it up properly.
- Backblaze B2 pay-as-you-go storageFirst 10 GB free; no minimum storage durationUS$6.95 per TB/month
- Object lock on Backblaze B2You pay for the locked storage as usualNo extra charge
- Downloads (egress) from B2Then US$0.01 per GBFree up to 3x your stored data
- Synology immutable snapshotsUses NAS disk spaceIncluded in DSM's Snapshot Replication
Example: 1 TB off-site with a 30-day lockabout US$7 to US$14 a month
Backblaze figures from its pricing and Object Lock pages, approximate, as of October 2026, excluding GST. A 30-day lock keeps more versions, so stored data can grow above the source size.
Check the current numbers on Backblaze's pricing page. Other S3-compatible providers offer object lock too; compare the price per TB, the minimum storage duration and download charges.
Setting up an immutable backup, step by step
The order matters: get backups working first, then add the lock, then lengthen it.
List what must be recoverable
File shares, Microsoft 365 or Google Workspace mailboxes, accounting data, your website and any server. Note how much data and how old a copy you could live with.
Create a separate backup account
Open the cloud storage account with a different email and password from your Microsoft 365 or Google admin, and turn on MFA. If ransomware steals your main admin login, it shouldn't reach the backups.
Create a bucket with object lock
Turn object lock on when creating the bucket and set a default retention, starting short (for example 14 days) in governance mode while you test.
Point the backup software at it
Use an application key limited to that one bucket, with no permission to bypass retention.
Test a restore
Restore a folder and a mailbox to a different location and open the files. A backup you have never restored is a guess.
Switch to compliance mode
Once a few weeks of backups and a restore have worked, move to compliance mode and the retention you settled on.
Common mistakes with immutable backups
Most failed recoveries come down to the same handful of gaps.
Immutable backup checklist
If you are already dealing with an attack, start with our ransomware first-steps guide for Singapore businesses. For servers, our comparison of snapshots and file backups covers which to use where.
Do it yourself or get help?
If you have one NAS and are comfortable in its settings, turning on immutable snapshots and an off-site backup with object lock is a realistic DIY job. The risk is in the details: the wrong key permissions, a lock that is too long, or a backup that has never been restored.
Our Backup & Ransomware Recovery (S$290) sets up off-site daily website backups and Microsoft 365 or Google Workspace backups, agrees a retention plan with you, runs a test restore with proof and leaves a one-page recovery guide. Storage fees are paid by you, in your own account.
Frequently asked questions
It is a backup copy that cannot be changed or deleted until a date you set, even by someone with your admin password. Cloud storage does this with object lock, and Synology NAS devices with immutable snapshots. It means ransomware that steals your login still can't wipe the copies you need to recover.
No. Sync services copy changes, including encrypted files, to every device and the cloud. Version history can help you roll back, but anyone with your account can usually delete files and versions. A proper backup with object lock or immutable snapshots is stored separately and can't be deleted early.
Long enough to cover the time an attacker might be inside before you notice, and short enough that storage costs stay reasonable. Synology recommends 7 to 14 days for immutable snapshots. For off-site object lock copies, 14 to 30 days is a sensible starting point. Start short and extend once you are sure.
In governance mode, users or keys with special permission can change or remove the lock, which is useful for testing. In compliance mode, Backblaze says nobody can remove the lock, only extend it. Compliance mode gives the real ransomware protection, but mistakes can't be undone, so test first.
Backblaze B2 lists pay-as-you-go storage at US$6.95 per TB per month as of October 2026, with no extra charge for object lock and free downloads up to three times your stored data. A small office with about 1 TB of data usually pays roughly US$7 to US$14 a month, depending on how many versions it keeps.