Most organizations don’t think hard about their offsite data vaulting provider until something goes wrong. A ransomware attack locks down primary systems. A compliance audit surfaces a gap in retention documentation. A disaster recovery test reveals that the tapes haven’t been rotated in six months.
By that point, the provider decision has already been made — and it may have been made too casually.
This guide is for IT managers, operations directors, and infrastructure teams evaluating offsite data vaulting services for the first time, or reconsidering a relationship that’s no longer working. It covers what offsite vaulting actually is, what separates a good provider from an adequate one, and the specific questions to ask before signing a contract.
What is offsite data vaulting?
Offsite data vaulting is the practice of storing backup media — most commonly LTO tape cartridges — in a secure, physically separate facility away from your primary data center or office. The geographic separation is the point: if your primary location is damaged, compromised, or destroyed, your backup media remains intact and accessible elsewhere.
This is distinct from cloud backup, which stores data on remote servers, and from onsite backup, which keeps a copy at the same location as your production systems. Offsite vaulting occupies a specific role in a layered data protection strategy — it provides an air gap that neither onsite nor cloud backup can fully replicate.
The air gap matters particularly for ransomware. When ransomware encrypts your production environment, it often moves laterally across connected systems, including cloud-synced storage. A physically vaulted tape that has never been connected to your network cannot be touched by that attack.
Who still uses offsite tape vaulting in 2026?
More organizations than you might expect. The assumption that cloud has replaced tape is common but not accurate across all sectors and use cases.
Offsite tape vaulting remains standard practice in industries with long-term retention requirements — healthcare (HIPAA mandates encrypted storage with audit trails for protected health information), financial services (SOX requires seven-year retention for financial records), and legal services. It’s also common among mid-market companies that have made a significant investment in tape infrastructure and are not ready to absorb the cost and complexity of a full cloud migration.
IBM i / AS400 environments in particular depend heavily on tape vaulting. These systems often run mission-critical ERP workloads and have tape backup architectures that have been in place for decades — replacing them with cloud is not a simple lift-and-shift.
The use case isn’t going away. What’s changing is that buyers have more options and more leverage than they did a decade ago — which makes choosing carefully more important, not less.
The core things a vaulting provider must get right
Before evaluating any specific vendor, it helps to be clear on the non-negotiables — the things that, if absent, disqualify a provider regardless of price.
Physical facility security
The facility housing your media should have, at minimum:
- Climate and humidity controls designed for magnetic media preservation
- Fire suppression systems appropriate for media vaults (not standard office sprinklers, which can destroy tapes)
- Surveillance coverage across all entry points and vault areas
- Badge access or biometric authentication with visitor logs
- Dual-custody controls for vault access — requiring two authorized personnel to access media
This last point is worth pressing vendors on specifically. Dual-custody is a meaningful security control that serious providers build into their operations. If a vendor can’t describe their access control process in concrete terms, that’s a flag.
Chain of custody documentation
Every time your media leaves your facility, gets transported, enters the vault, and is retrieved, that movement should be documented and auditable. A reputable provider gives you a chain of custody record for every transaction — pickup, delivery, vault entry, retrieval request, and return.
This documentation matters for compliance. If you’re subject to HIPAA, SOX, or GDPR, your auditors will want to see that you can account for where your media has been and who has touched it.
Transportation security
Media in transit is media at risk. Ask providers specifically how tapes are transported: dedicated vehicles or third-party couriers, whether media is encrypted before transport, and what happens in the event of a vehicle incident or loss. The answer to that last question reveals more about a provider’s operational maturity than almost anything else.
Defined retrieval SLAs
If you need to recover data from vaulted media during a disaster, how quickly can the provider get it to you? Standard retrieval windows vary — some providers offer next-business-day, some offer same-day for emergencies, and some offer on-demand access with on-site retrieval within a defined number of hours.
Know your RTO requirements before you evaluate this. If your recovery time objective is 24 hours, a provider whose standard retrieval window is 48 hours is the wrong fit, regardless of their pricing.
Certifications to require — and what they mean
Certifications are not a substitute for due diligence, but they are a meaningful signal that a provider has subjected their operations to third-party scrutiny.
SOC 2 Type II is the most important certification to look for in a data vaulting provider. A SOC 2 Type II report — as opposed to Type I — demonstrates that a provider’s security controls have been tested over a period of time (typically six to twelve months), not just assessed at a single point. It covers security, availability, processing integrity, confidentiality, and privacy. Many enterprise procurement teams will not engage with a vaulting vendor who cannot produce a current SOC 2 Type II report.
HIPAA compliance is mandatory if your organization handles protected health information and you’re entrusting a vendor with media that contains it. Note that HIPAA compliance is not a certification — it’s a legal obligation. Vendors cannot be “HIPAA certified” in the way they can be SOC 2 certified. What you want to see is a signed Business Associate Agreement (BAA) and evidence that the vendor has implemented the required safeguards.
PCI DSS matters if your backup media contains cardholder data. Relevant for retail, hospitality, and financial services organizations.
NAID AAA Certification is specific to secure destruction and is worth asking about if your contract includes end-of-life tape destruction services. It means the destruction process has been independently audited.
Ask for copies of current certifications, not just verbal assurances. Certifications lapse, and a provider who was SOC 2 compliant two years ago may not be today.
Questions to ask before signing
These are the specific questions that separate a vendor evaluation from a vendor conversation:
On security and access:
- What are your dual-custody controls for vault access?
- Who has physical access to our media, and how is that access logged?
- How do you handle a terminated employee who previously had access?
On transportation:
- Do you use dedicated vehicles or third-party couriers for media transport?
- Is our media encrypted before it leaves our facility, and who holds the encryption keys?
- What is your documented process in the event of a transport incident?
On retrieval:
- What are your standard and emergency retrieval SLAs?
- What is the process for requesting retrieval outside business hours?
- Have you conducted a documented disaster recovery retrieval test in the past 12 months, and can we see the results?
On compliance:
- Can you provide your current SOC 2 Type II report?
- Will you sign a Business Associate Agreement if we require one?
- How do you handle data deletion requests under GDPR or CCPA for media in your vault?
On operations:
- What happens to our media if your company is acquired, or if you go out of business?
- What is your process for media inventory reconciliation, and how often do you conduct it?
- Can you give us a reference from a customer in our industry?
That last question — a reference from a customer in your industry — is underused. A provider who vaults media for healthcare organizations has different operational muscle than one who primarily serves financial services firms. Industry experience matters, and references are the easiest way to validate it.
Offsite vaulting vs. cloud backup: choosing the right role for each
A common mistake in evaluating offsite vaulting is treating it as a direct competitor to cloud backup. It isn’t. They solve different problems and are most effective when used together.
Cloud backup excels at frequent, granular recovery of recent data — recovering files from yesterday, restoring a virtual machine from last week. It’s fast, scalable, and doesn’t require physical media management.
Offsite tape vaulting excels at long-term retention, regulatory compliance, and air-gapped protection against ransomware and catastrophic events. Recovery from vaulted media takes longer — hours or days rather than minutes — but the data is physically isolated from any network attack.
The 3-2-1 backup rule captures this well: three copies of your data, on two different media types, with one copy offsite. In practice, this often means primary storage, a cloud or disk backup, and offsite tape — each layer serving a distinct purpose.
Where organizations get into trouble is relying on cloud backup as their only offsite protection and discovering, during a ransomware incident, that their cloud-synced backup was also encrypted. Offsite tape with a genuine air gap closes that vulnerability.
Regional considerations
Offsite vaulting is a local service in a way that cloud backup is not. Media needs to be physically transported to and from your facility, which means provider proximity matters — not just for cost, but for retrieval SLA performance.
If you’re evaluating providers in a specific metro area, ask explicitly whether the vault facility is operated directly by the provider or managed through a partner network. Some national providers subcontract local vaulting to regional operators, which adds a layer of complexity to chain of custody documentation and SLA accountability.
Location-specific availability matters, too. Organizations in San Diego, Calgary, or other markets with active enterprise infrastructure will find different provider ecosystems than those in major metro areas. In smaller markets, the shortlist may be short — making the due diligence questions above even more important, since you have less competitive pressure working in your favor.
What to expect on pricing
Offsite vaulting pricing typically has three components: a per-tape storage fee (charged monthly, per cartridge in the vault), a transportation fee (per pickup/delivery), and a retrieval fee (per emergency or expedited retrieval request).
Pricing varies significantly by market, media volume, and service tier. Expect storage fees in the range of a few dollars per tape per month for standard service. Transportation fees depend on frequency and distance. Emergency retrieval can carry meaningful premiums.
When evaluating pricing, pay attention to what’s included in the base contract and what triggers additional fees. Some providers charge separately for inventory reconciliation, chain of custody documentation, or after-hours retrieval. These fees can add up meaningfully if your operational needs require them regularly.
Get itemized pricing, not bundled quotes, and ask specifically what the per-event cost is for emergency retrieval. That number tells you what a disaster will actually cost beyond the baseline contract.
Summary: what a good provider looks like
A reputable offsite data vaulting service will:
- Operate a purpose-built, climate-controlled vault with documented physical security controls
- Provide SOC 2 Type II reports and sign a BAA if required
- Document every chain of custody event with auditable records
- Transport media in dedicated or purpose-equipped vehicles, with encryption in transit
- Offer defined retrieval SLAs with emergency options and a documented test history
- Give you references from customers in your industry
A provider who checks most of these boxes but can’t answer the retrieval and chain of custody questions with specificity is worth scrutinizing carefully. The value of offsite vaulting is entirely dependent on whether you can actually get your data back when you need it. The evaluation process should treat that outcome — not the sales conversation — as the test.
Related reading on DataJD:
- How tape rotation works — and why it still protects against ransomware
- Why offsite vaults still exist in the age of cloud storage
- What is recovery time objective (RTO)?
Leave a Reply