Look into FileFlows, I used that after my tdarr server shit the bed to act as my conversion utility for my media libraries. Done a very good job of transcoding my Library into a consistent format.
If you have any inclination to use docker, they offer a generator to make the compose file for you
Your off-site backup solution shouldn’t have to care about that level of security because you should be encrypting your backups before they leave your network. Even if you have a solid backup host in the cloud, you still want to encrypt your backup data before you send it to their hosted repo.
Unless your vendor has a reason to read your backups, they shouldn’t be able to.