Four ways to make data non-erasable, and four different residual risks.

The four models below are not competitors. Most serious designs use at least two, because each fails differently.

The governance and compliance distinction deserves more attention than it usually gets. Governance mode is reversible by design, so a repository configured in governance mode gives you a strong audit trail and a weak guarantee. If the threat model includes a stolen administrator credential, and for a backup repository it should, compliance mode or physical WORM is what actually holds. Note also that in either mode the retain-until date can be pushed further out but not pulled in, and that a legal hold is a separate flag with no clock of its own, so it stays until somebody with the right permission removes it.

Optical WORM sits at the other extreme. An INCOM/StorEasy WORM appliance presents a NAS cache over NFS, CIFS and S3, and writes committed files through to Blu-ray BD-XL media that cannot be rewritten in place. The datasheets describe a four-copy pattern across two technologies with two copies held offline, but the second BD-XL drive is listed as optional, so that pattern depends on the configuration you actually buy. The WORM appliance page covers the hardware side in more detail.

Modern intrusions do not start by encrypting production. They start by making recovery impossible, and they do it well before anyone notices the primary event.

1. Credential harvesting, usually of a backup or hypervisor administrator.
2. Discovery and deletion of the backup catalogue, or expiry of retention policies from inside the backup console.
3. Deletion or reformatting of the backup repository and any snapshots.
4. Only then, encryption of production data.

Steps two and three are where immutability earns its budget. Nothing at the storage layer prevents an attacker from encrypting live volumes. What storage can do is refuse the delete in step three, so that step four becomes a recovery exercise rather than a negotiation. That is why the strongest enforcement belongs on the backup repository and the archive, not on the primary tier.

It also means the catalogue matters as much as the data. A protected repository whose index has been destroyed is a pile of opaque objects. Any immutability design should state where the catalogue lives, how it is protected, and how it would be rebuilt. QStar Archive Manager keeps its own media and offline-media tracking alongside retention controls and legal hold, which is a different failure domain from the backup application's catalogue. Two independent indexes is a deliberate design choice, not redundancy for its own sake.

Software-enforced retention is only as trustworthy as the system enforcing it. If the appliance's management plane is compromised, or if an administrator with full rights decides to act, a policy that lives in software is a policy that can be argued with. Physical WORM media removes that argument for the copy already written, but not for anything still in cache.

Object Lock in governance mode is reversible, as described above. Treating it as equivalent to compliance mode is one of the more common gaps found during assessments.

An air gap does not help if you have already replicated damage into it. If corrupted or encrypted files were archived before anyone noticed, an offline copy preserves them exactly. Immutability is indifferent to content. It protects a bad copy as faithfully as a good one.

That is the gap verification closes. Checksums at ingest, periodic re-reads of archived media, and scheduled restore tests are what turn a retention claim into a recovery capability. The StorEasy appliances state MD5 checksums at file level, which is useful for detecting media degradation and accidental corruption. It is not a defence against a deliberate attacker, and should not be described as one. Where tamper evidence is a requirement, digital signatures and independent verification records belong in the design.

Finally, retention is not compliance. WORM media, retention locks, audit logs and legal hold support an obligation. Meeting it also depends on records classification, retention schedules, access control and a legal interpretation that no storage product can supply.

The clock starts when the object is written, not when the policy is applied and not at the end of the fiscal year. From that moment until expiry, delete and overwrite requests are refused, including your own. This has two consequences worth planning for.

Capacity becomes a floor, not a ceiling. If you ingest 40 TB a year, as an illustration, and set a seven-year retention, the repository grows to roughly 280 TB before a single byte becomes eligible for deletion. Nothing you do in year three reduces that. Early over-retention, such as applying a ten-year lock to data that legally needs three, is not a conservative choice. It is a purchase commitment.

Mistakes are also durable. An object written with the wrong retention period stays for its full term. Where the write path is automated, and it usually is, a misconfigured policy replicates that error across every object it touches. Staged rollouts and a short-retention validation bucket cost very little and prevent a long-lived problem. This interacts directly with how backup repositories are sized, which is covered on backup and recovery storage.

Two questions come up in almost every UAE and wider GCC engagement, and neither is answered by a datasheet.

The first is where the data physically sits. On-premises WORM appliances and optical libraries keep archived records inside the facility, which matters for institutions operating under residency expectations from sector regulators or from their own board. An on-premises S3 endpoint that accepts writes from backup platforms and then migrates them to optical WORM keeps that boundary intact while still presenting a modern object interface. Financial institutions face this most sharply, and banking and financial services goes further into the retention side.

The second is custody. An air gap is a procedure, not a line item. Removing a disc from a library creates the gap, but the protection only exists if someone owns media removal, cataloguing, storage conditions, retrieval time and periodic read-back testing. Media inside a network-attached library is nearline storage, and calling it air-gapped is a misuse of the term. Aban Smart designs the enforcement model and the operational procedure together, because the second one is what decays.

Other solution areas are listed on the solutions overview. If you want an existing repository examined against these four models, request an assessment.