Technologies are described herein for providing secure data protection and recovery. A virtual data center can be created on backup servers to manage data backup for a specific client. Backups can be performed by a master server in the virtual data center initiating a secure network connection with a client computing device at a random or pseudo random time within a backup window specified by the client. A backup agent on the client computing device can execute a data mover program complied at the client's computing system but received from the master server to retrieve and save backup data at a random or pseudo random temporary location. The saved data can be transmitted and stored on data storage accessible only by a storage server. Backup data can be inspected in an isolated inspection server and be made retrievable through a secure data repository accessible by the client.