--- name: vmwaresolutions-data-security title: Securing your data in VMware Solutions description: Know what data is stored and encrypted and how to delete any stored data to ensure that you can securely manage your personal data when you use IBM Cloud® for VMware Solutions. last-updated: 2025-11-25 --- > ## Documentation Index > The table of contents for this documentation set is at https://cloud.ibm.com/docs/vmwaresolutions?format=markdown > The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt > Use these files to discover more information as needed. # Securing your data in VMware Solutions {: #data-security-mng-data} As of 17 July 2025, new automated installations of Red Hat® OpenShift® for VMware® are no longer available for new or existing deployments of VMware Cloud Foundation for Classic - Automated instances. You can still use or delete your existing Red Hat OpenShift for VMware automated installations until 16 July 2026. The service will no longer be available from 17 July 2026. {: deprecated} Know what data is stored and encrypted and how to delete any stored data to ensure that you can securely manage your personal data when you use IBM Cloud® for VMware Solutions.  {: shortdesc} ## Data storage and encryption in VMware Solutions {: #data-security-data-storage} When a user onboards to VMware Solutions and orders instances, we store and manage user data of configuration and metadata that is associated with the user and ordered instances. That user data includes the following items. For VMware Cloud Foundation for Classic - Automated instances, the user data includes the following items: * IBMid (email) * Instance configuration information * Instance access information such as login credentials to VMware Cloud Director, VMware vCenter Server®, and VMware NSX® Manager * IBM Cloud classic infrastructure credentials (username and API key) This configuration data and metadata is stored and managed by IBM. It is encrypted at REST and in transit. Additionally, sensitive data such as API keys and access information are encrypted with customer–specific encryption keys. For VCF for Classic - Automated, you can bring your own data to IBM Cloud bare metal servers and IBM Cloud File Storage for Classic and IBM Cloud Block Storage for Classic that is managed by your VMware instance. All of this data is managed by you and not managed by IBM, and you have the option of encrypting it using various solutions. These solutions include the following options: * KMIP™ for VMware service along with IBM Cloud Key Protect or IBM Cloud Hyper Protect Crypto Services to enable vSAN™ or VMware vSphere® encryption for your workloads * Other self–managed VMware–compatible encryption technologies ## IBM policy for data protection with Veeam {: #data-security-veeam-policy} You can configure the Veeam service in various ways. Some options include self-service, but in all cases IBM defaults to keeping backup restore points and chains. Consider the following IBM policies for data protection with Veeam. ### Backup job creation {: #data-security-backup-job-create} When you create a backup job, you add VMs or vApps to the job for data protection and also define the backup job schedule. The IBM policy is to never remove your VMs or vApps from your backup jobs or to delete any backups without your permission. ### Removal of backups {: #data-security-backup-remove} To remove backups, you can choose to remove VMs or vApps from the backup job or delete VMs or vApps that were previously backed up. In either case, you are responsible for deleting the old restore points. Before you remove VMs or vApps or delete the restore points, consider the following information. #### Backup chain format {: #data-security-backup-remove-chain} For Veeam 12 and later, the IBM policy uses per-machine backup with separate metadata files for backup chain format. For more information, see [Backup Chain Formats](https://helpcenter.veeam.com/archive/backup/120/vsphere/per_vm_backup_files.html){: external}. #### Backup job retention policy {: #data-security-backup-remove-retention} The backup retention policy defines how many restore points to retain on disk. After the allowed number of restore points is exceeded, Veeam applies the retention policy to remove the earliest restore point from the backup chain. Depending on your business requirements, it is your responsibility to set the retention policy when you create the backup job. For more information, see [Short-Term Retention Policy](https://helpcenter.veeam.com/archive/backup/120/vsphere/retention_policy.html){: external}. You can update the retention policy later. However, the new settings are applied only to the new data and cannot be applied to previous data that maintains the previous retention policy setting. {: note} #### Removal of restore points {: #data-security-backup-remove-restore-points} Veeam keeps at least one full backup chain and doesn't remove old restore points until a second full backup (synthetic or active) is created and a new backup chain starts. For more information, see [Removal of Restore Points](https://helpcenter.veeam.com/archive/backup/120/vsphere/retention_separate_vms.html){: external}. #### Retention policy for deleted items {: #data-security-backup-remove-ret-delete} Veeam has the **Remove deleted items data after** setting available for each backup job to delete restore points for deleted items after a set number of days. The IBM policy does not enable this setting by default, but can enable the setting when a support case is opened. You must provide the following information in the support case to enable the setting. * The names of the backup jobs where you want to enable the setting. * The value, in days, to set for the **Remove deleted items data after** setting. When this option is enabled, the restore points for any VM or vApp that is no longer processed by the backup job is permanently deleted after the set number of days. {: important} For more information, see [Retention Policy for Deleted Item](https://helpcenter.veeam.com/archive/backup/120/vsphere/retention_deleted_vms.html){: external}. The retention policy is applied only if the job stops creating backups for the entire vApp. Therefore, a removal of VMs within vApps does not result in automatic deletion of those restore points. It is your responsibility to delete the restore points. {: note} ### Moving items between backup jobs {: #data-security-backup-moving-between} You can move VMs or vApps between backup jobs. Any VM or vApp that you move to a new backup job results in a new backup chain and restore points under the new backup job. Removing the original backup and restore points in this case falls into the same category as removing backups. You are responsible for deleting the original restore points. ## Protecting your sensitive data in VMware Solutions {: #data-security-data-encryption} ### IBM Cloud Support access {: #data-security-ibm-access} IBM Cloud Support has access to your VMware virtualization environment. For VCF for Classic - Automated, IBM maintains this access to enable automated Day 2 operations such as capacity expansion, and to enable support for problem resolution. For more information, see [Policy for accessing clients' instances](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vc_compl_info&format=markdown#vc_compl_info-policy-for-access-client-inst) and [Consent to accessing client environments](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vc_compl_info&format=markdown#vc_compl_info-consent-to-access-client-environment). For VCF for Classic - Automated, you can take steps to limit IBM Cloud access to your instance. These steps can include the following actions: * You must create a functional IBM Cloud account to own the API key that you provide to VMware Solutions for provisioning. Ensure that you monitor the mailbox of this account for notices. * You can regenerate this API key to revoke automation and support access to your API key. When you need to restore IBM Cloud access, for example, to deploy a new host, you must reenter the API key on the **Settings** page of the VMware Solutions console. * IBM Cloud retains a set of [user IDs](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-audit_user_ids&format=markdown) in your instance. You can disable or revoke these user IDs. When you need to restore IBM Cloud access, for example, to deploy a new host, you must re-enable these accounts. If you changed the password for these accounts, you must open a support ticket to provide the updated password to IBM Cloud. ### About customer-managed keys {: #data-security-about-encryption} For VCF for Classic - Automated, envelope encryption is used to offer customer–managed keys. Envelope encryption within VMware Solutions uses the [KMIP for VMware service](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-kmip_standalone_considerations&format=markdown) to provide key management for vSphere or vSAN encryption. This offering uses IBM Cloud Key Protect or IBM Cloud Hyper Protect Crypto Services for key wrapping and unwrapping. Key Protect offers Bring Your Own Key (BYOK) capability by using FIPS 140–2 level 3 certified hardware security modules (HSMs). Hyper Protect Crypto Services offers Keep Your Own Key (KYOK) capability by using FIPS 140–2 level 4 certified HSMs. ### Enabling customer-managed keys for VMware Solutions {: #data-security-using-byok} You can use IBM Cloud key management with vSphere or vSAN encryption. For more information, see the [KMIP for VMware implementation guide](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-kmip-implementation&format=markdown). ### Working with customer-managed keys for VMware Solutions {: #data-security-working-with-keys} For more information about considerations for VMware key management, key revocation, and key rotation, see: * [KMIP for VMware considerations](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-kmip-design&format=markdown#kmip-design-considerations) * [KMIP for VMware management guide](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-kmip-implementation&format=markdown#kmip-implementation-key-rotation) ## Deleting your data in VMware Solutions {: #data-security-data-delete} ### Deleting VMware Solutions instances {: #data-security-service-delete} When you delete a VCF for Classic - Automated instance, all associated customer workload data is deleted. The underneath IaaS resources are also deleted at the end of the corresponding billing cycle.  Along with the instance deletion, the instance's configuration and metadata are also marked as "inactive". You can request complete deletion of the metadata through a "secure wipe" ticket.   ### Restoring deleted data for VMware Solutions {: #data-security-data-restore} You are responsible to make provision for backup and recovery of all data you bring to VMware Solutions. IBM Cloud does not back up your workload data and cannot restore it after deletion. ## Related links {: #data-security-related} * [Managing IAM access for VMware Solutions](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-iam&format=markdown) * [Activity tracking events for VMware Solutions](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-at_events&format=markdown)