Bareos vs Veeam: regulatory differences and compliance risks

In our previous comparison of Bareos and Bacula, we looked at backup features and the difference between open-source and open-core licensing. When comparing Bareos and Veeam for European financial and critical infrastructure companies, the main question is legal: which country’s laws govern the vendor? 

Backup software has access to every database, file server and configuration in a company. Because of that access, the country where the software vendor is incorporated matters as much as where the backup servers sit.

Veeam started in Europe, but moved its headquarters to the United States after Insight Partners acquired the company in 2020. Because Veeam is a US company, it must obey US law. If a European bank runs Veeam on its own servers in Frankfurt, Veeam does not hold the bank’s backups. But the bank still depends on closed code, updates, licenses and support from a company under US jurisdiction. Where Veeam itself holds data, for example in its cloud storage Veeam Data Cloud Vault, which is built on Microsoft Azure, US law can reach that data directly.

And this is not unique to Veeam. The same legal exposure applies to any backup or storage platform owned by a US parent company, including IBM Storage Protect, Commvault and Cohesity. Veeam is simply the most common example in Europe.

Bareos is made in Germany, based in Cologne and works under German law and EU data protection rules, including the GDPR. The software is published under the AGPLv3 open-source license and anyone can read the source code on GitHub.

The CLOUD Act, FISA Section 702 and US export controls

In 2018 the US issued the CLOUD Act. After that, US authorities can require a US provider to hand over data in its “possession, custody, or control”, even if the servers sit in Frankfurt or Paris. Yet in The CLOUD Act Is The Tip Of The Iceberg, Marc Linster points out that the CLOUD Act is only the most visible statute. European companies using US software also face FISA Section 702 (Foreign Intelligence Surveillance Act) and US sanctions and export rules from OFAC and BIS.

The CLOUD Act is used for criminal investigations, whereas FISA 702 is an intelligence law. Section 702 became widely known in 2013 when Edward Snowden revealed how US intelligence agencies used it to collect data directly from US tech companies, and those findings later led the European Court of Justice to strike down two EU-US data transfer agreements. As NextHop explains in FISA Section 702: US surveillance and European data, FISA 702 lets US agencies collect data on non-US persons outside the US without an individual court warrant. Providers that receive such an order must keep it secret, so the affected companies usually never learn about it and cannot challenge it. The US Congress has not yet renewed Section 702, but according to the Brennan Center, surveillance under it can continue until March 2027 even without renewal.

NextHop also points out that customers of closed-source software cannot inspect what is inside a binary patch. Veeam states that customers control their own encryption keys, but because the code is closed, customers have to take Veeam’s word for it.

Linster also notes that US executive orders or directives from BIS and OFAC can bar US vendors from providing patches, licenses or support to specific foreign organizations:

• Microsoft and the ICC (2025): After the US sanctioned the chief prosecutor of the International Criminal Court in The Hague, he lost access to his Microsoft email. Who switched it off is disputed. Microsoft says it never suspended its services to the ICC and later had to correct its own testimony in the UK Parliament. In October 2025, the ICC announced it would move to openDesk, a German open-source suite.
• Adobe in Venezuela (2019): Following US Executive Order 13884, Adobe deactivated all customer accounts in Venezuela in October 2019, cutting off access to software and cloud services across the country.

With Bareos, engineering teams can review the source code of every update before they deploy it, including how encryption and keys are handled. Orders aimed at US vendors do not apply to a German company directly. And because the code is open source, it stays available to customers even if support were ever interrupted.

Why contracts do not fix the problem

To pass audits, European companies often sign Standard Contractual Clauses with US vendors or point to the EU-US Data Privacy Framework. A private contract between a European bank and a US vendor, however, does not exempt the vendor from US federal law.

In a March 2026 article, Digital sovereignty in companies: Making cloud and AI use legally compliant, the German law firm Heuking notes that contracts and the Data Privacy Framework alone do not rule out access from outside the EU. It recommends, among other things:

• Separating sensitive workloads and using client-side encryption with your own keys.
• Regularly updating Transfer Impact Assessments (TIAs) and preparing for the possibility that the current EU-US framework is struck down. The European Court of Justice (ECJ) already struck down its predecessors, Safe Harbor and Privacy Shield.
• Being able to simulate a change of provider, at least theoretically and organizationally.

Veeam offers data sovereignty options, such as choosing the storage region, holding your own encryption keys and working with sovereign service partners. These options can keep data in the EU, but the software and its update pipeline still come from a US company.

Buying through a European partner or reseller does not change this. The contract may look European, but the code and licenses still come from the parent vendor, and the laws of the vendor’s home country still apply. Under DORA (Digital Operational Resilience Act), banks have to check the entire ICT supply chain anyway, which means assessing the software maker rather than stopping at the reseller.

The more you depend on one vendor, the less control you have. DORA calls this concentration risk (Article 29) and requires banks to check, before signing, whether a provider can be easily replaced. In practice, DORA and NIS-2 force every regulated company to answer three questions about its critical ICT providers: Can you leave without disrupting your business? Do you know where your data is? Can you get your data back if the vendor fails?

With Bareos, the code is open and stays available whatever happens to the vendor. Your backups sit on systems you choose, and you can restore them with or without a subscription.

With Veeam, every answer runs through a foreign company. Because the code is closed, you cannot verify it yourself, and updates, licenses and support come from the US. If a foreign sanction or court order changes the rules, your exit plan has to work overnight, which is why DORA requires banks to document and test that plan in advance.

Warnings from European authorities

Many European authorities no longer take today’s EU-US data transfer rules for granted. In February 2025, the Norwegian Data Protection Authority advised organizations to prepare an exit strategy in case the EU-US Data Privacy Framework is challenged. According to the law firm Dykema, Denmark’s Ministry for Resilience and Preparedness and Germany’s Federal Ministry of the Interior issued similar warnings. For now the framework still stands. The EU General Court upheld it in September 2025, but the case has gone to the European Court of Justice.

Authorities are also looking more closely at where data actually goes. In a recent decision, the Danish Data Protection Authority criticized 51 Danish municipalities for how they used Google Workspace and Chromebooks in schools. The municipalities had a data processing agreement with Google. But they could not show that they had checked Google’s sub-processors, some of them outside the EU. The authority made it clear that contracts alone are not enough.

In September 2026, the Norwegian government also presented plans to strengthen the country’s digital sovereignty and make it less dependent on American technology giants.

A backup holds a copy of almost everything an organization has, so these questions apply to backup as much as to cloud services. With self-hosted, open-source backup software like Bareos, you decide where your backups are stored, and no cloud sub-processors are involved unless you choose to add them.

Regulatory comparison

Choosing between the two

Many IT teams know Veeam well and it has a large ecosystem. But because Veeam is a US company with closed code, European companies (that are regulated under DORA, NIS-2 and the GDPR) have to plan extra compliance work around it. Bareos is open-source backup made in Germany and your backups stay on systems you choose, under European law.