Backblaze B2 Enforces Default Server-Side AES-256 Encryption Across All New Uploads

Backblaze has officially activated mandatory, default server-side encryption (SSE-B2) across its B2 Cloud Storage infrastructure. Starting September 14, 2026, all newly uploaded and destination-copied objects in new buckets are automatically encrypted at rest using AES-256 with Backblaze-managed keys. The change applies seamlessly without requiring adjustments to existing client application code, CLI configurations, or S3-compatible API requests. Existing buckets are receiving the update on a rolling basis, while customer-managed key encryption via SSE-C remains available for organizations that require external key governance. For cloud architects, DevOps engineers, and SecOps teams, the transition to secure-by-default object storage removes the risk of accidental unencrypted data ingestion. Historically, enforcing encryption across massive data sets required organizations to mandate client SDK headers, write custom IAM policy conditions, and constantly monitor infrastructure-as-code deployments for configuration drift. Establishing automated AES-256 encryption at the storage tier guarantees compliance baselines across all new ingestion pipelines without imposing performance penalties, compute overhead, or additional storage fees. This update reflects a broad, long-standing industry shift toward hardening the foundational building blocks of cloud infrastructure. As unstructured data estates grow exponentially to support high-throughput AI training datasets, telemetry logs, and media archives, cloud providers are closing legacy gaps where data could be persisted in the clear. Following patterns previously adopted across hyperscale storage ecosystems, the elimination of opt-in encryption ensures that baseline data security is embedded directly into the infrastructure fabric rather than treated as a supplementary operational task. In practice, engineering teams running S3-compatible workflows against Backblaze B2 do not need to modify their upload tools or update authentication headers. However, practitioners must understand that always-on encryption is forward-looking and non-retroactive. Pre-existing objects stored in unencrypted states prior to the bucket update will retain their original metadata unless explicitly re-uploaded or rewritten via copy operations. DevOps teams managing compliance-bound environments should run inventory reports across legacy buckets and execute batch copy workflows to ensure historical objects meet enterprise encryption mandates.