In the context of ransomware protection and , immutable storage is a central concept — but a misunderstood one. Not all forms of immutability are equivalent.

Software / Object Lock: immutability is enforced through software policies — retention policies, Object Lock, immutability flags. In Governance Mode, administrators with sufficient rights can lift these policies. In Compliance Mode with Multi-Person Authorization, this is harder, but immutability remains a configuration setting. With compromised admin credentials or zero-days in the management layer, immutability can be overridden.

Hardware : immutability is enforced at device level, independent of operating system, firmware, drivers or user privileges. Silent Cubes from FAST LTA enforce hardware at firmware level: once written, data is physically immutable. No administrator, no root access, no software update can modify written data.

The consequence for practice and compliance: software meets compliance requirements formally ( Art. 12) — but only in combination with documented organizational measures. Hardware meets these requirements technically, independent of organizational measures. In a tax audit, legal dispute or regulatory review, hardware is the more robust position.

Frequently asked questions

Object Lock is a software-enforced lock function used in S3-compatible storage systems and cloud services. In Governance Mode, an admin with sufficient rights can override the retention. In Compliance Mode it is harder, but it remains a software policy. Hardware WORM enforces immutability in the hardware controller — no software, no operating system, no user account can modify written data.
Partially. Immutable storage protects data from being encrypted or deleted — but only as long as the protection is active and the system is reachable. Software-based immutability can be overridden by an attacker with compromised admin credentials. Hardware WORM provides stronger protection, but the system remains addressable via the network. The most complete protection is the combination of hardware WORM and physical air gap: immutable and physically unreachable.