You've evaluated Duplicati, it does what you need, and the license cost is zero. Then the request hits security review and comes back with a list of questions. None of them are about encryption or restore performance. They're about whether open-source software belongs in a compliance-bound organization at all.

Those questions are fair. Here are the five you'll almost certainly hear, and how to answer each one honestly.

Objection 1: "Who do we call when it breaks?"

This is the real objection behind most open-source hesitation. A community forum is not an escalation path, and a CISO can't put "post on GitHub and wait" in an incident runbook.

The answer for Duplicati is that "open source" describes the license, not the support model. Duplicati Inc. is a commercial company behind the project, and Pro and Enterprise plans come with a support relationship rather than a best-effort forum. If your organization needs a named vendor with a contract, that exists.

What open source adds on top is something proprietary vendors can't offer: if the vendor's answer is slow or wrong, your own engineers, or a contractor you choose, can read the code and fix it. You are never fully dependent on a support queue. That's a stronger position than a closed product with a good SLA, and it's worth saying so explicitly in the review.

Objection 2: "Who maintains it, and will it still be maintained in five years?"

Abandoned open-source projects are a genuine risk. The way to evaluate it is the same way you'd evaluate any vendor: who is paid to work on it, how active is development, and what happens to your data if they stop.

Duplicati has been in development since 2008, has a company funding full-time engineering, and a public commit history anyone on your team can inspect this afternoon. That last point matters. With a proprietary product you're trusting a roadmap slide; with Duplicati you can see release cadence, issue response times and who's contributing, in the open.

The "what if it stops" question has an unusually good answer for backup software specifically, and it's covered under lock-in below.

Objection 3: "Can we audit it?"

For a security team, this is where open source stops being a liability and becomes the strongest argument in the room.

Duplicati's encryption is done client-side before anything leaves the machine, using standard, well-understood components, AES-256 or GnuPG, rather than a proprietary scheme. Your security team doesn't have to take the vendor's word for how keys are handled or what gets sent where. They can read it. They can build it from source and compare the hash. They can run their own static analysis. Try asking a closed-source backup vendor for that.

Auditability of the software is one half. The other half is auditability of the backups themselves: can you prove, to an auditor, that every endpoint backed up last night and that the backups are restorable? That's not a property of the client; it's a property of your operations. More on that below.

Objection 4: "What are the licensing implications?"

Some open-source licenses carry obligations that make legal teams nervous, particularly copyleft licenses that can affect software you distribute. This is a legitimate thing to check, and it's a short check.

Duplicati is released under the MIT license, one of the most permissive open-source licenses in existence. There's no copyleft obligation, no restriction on commercial use, and no requirement to disclose anything about your environment. Your legal team will recogni`e it immediately, and it will likely already be on their approved list.

The Console, Duplicati Inc.'s hosted management layer, is a separate commercial service with its own terms, in the same way any SaaS product is. The backup client on your endpoints stays MIT.

Objection 5: "Aren't we just trading one lock-in for another?"

Every backup vendor locks you in somewhere: proprietary archive formats, storage you can only use through their tooling, licenses that stop working the day you stop paying. The nightmare scenario is discovering, mid-restore, that you need a license key or a vendor account you no longer have.

Duplicati is built specifically so that scenario can't happen. Backups are stored as standard, documented archive files, encrypted with standard tools, on storage you own: S3, Azure Blob, Google Cloud, SFTP, a local NAS, or any of dozens of other backends. There is no mandatory Duplicati-owned storage tier and no license check on restore. If the company vanished tomorrow, the source code, your data and the tools to recover it would all still be in your hands.

That's the answer to Objection 2 as well. The exit plan for Duplicati is: you already have everything.

Where open source alone falls short, and what to do about it

Be honest in the review about the gap. A backup client running on 400 machines, each with its own local configuration and its own logs, is exactly the kind of setup that makes a CISO uneasy, and rightly so. "Every endpoint is backed up" is a claim you need to be able to demonstrate, not just believe. Free software doesn't give you that on its own, and neither does a proprietary client without a management layer.

This is what the Duplicati Console is for. It's a central management interface where all your Duplicati installations, across sites, subsidiaries or client organizations, report in. From one dashboard you can see which backups ran, which failed, which machines have gone quiet, and push configuration changes without touching each endpoint. The Alert Center lets you define the conditions that should page someone, so a silently failing backup becomes a ticket rather than a discovery six months later. Reporting gives you the evidence trail an auditor asks for. Registration tokens let you onboard new machines at scale rather than one at a time.

In other words, the Console closes the two objections that open source can't answer by itself: it gives you a vendor relationship for support, and it gives your security team the visibility to prove the backups are working.

Taking it to the review

Summarized for the meeting:

• Support: commercial plans from Duplicati Inc., plus the fallback of fixing it yourself, which closed vendors can't offer.

• Maintenance: a funded company, 18 years of history, and a development record you can inspect rather than a roadmap you have to trust.

• Auditability: client-side encryption with standard components, source you can read and build, and Console reporting for the operational side.

• Licensing: MIT. No copyleft, no commercial restrictions.

• Lock-in: open formats on storage you control, no license check on restore, no vendor dependency for recovery.

The question "is open source safe for business" usually has a hidden assumption: that a closed product would be safer. For backup, where the whole point is being able to recover under the worst conditions, the opposite is often true. The safest backup is the one you can restore without asking anyone's permission.