Frequently Asked QuestionsFrequently Asked Questions

A seat is one licensed Microsoft 365 user mailbox (USER_MAILBOX type). Shared mailboxes, room mailboxes, and equipment mailboxes are not counted. Active seats (protected, discovered, or paused) are billed at full rate — pausing a mailbox does not archive it. Archived seats, where the mailbox is no longer found in Microsoft 365 but its backup data is retained, are billed at 50% of the per-seat rate. Billing is based on the peak seat count during the billing period to prevent end-of-month adjustments.

Archived seats are mailboxes that are no longer found in Microsoft 365 — typically because the user has left the organisation — whose historical backup data is retained for compliance or legal hold purposes. Pausing a mailbox does not archive it; a paused seat still bills at the full rate. Archived seats are billed at 50% of the active per-seat rate across all seat bands. They do not count toward per-seat add-on charges.

Moving up a band applies immediately. Moving down takes effect at the start of the next billing month, so the month you are in bills at the band you were on. Nothing about your feature set changes either way, the bands set your committed seat count, not what the software does.

Cancelling a subscription, non-payment or a suspension of access does not by itself delete anything. When your agreement with us ends, we stop taking new backups and, for 90 days, keep the records we hold about your backups; restores stay available for those 90 days, and export too where it is enabled for you (a direct customer asks us, and we run the restores). During those 90 days, the retention policy configured for each tenant continues to apply. Backups in a bucket you own stay there; backups in a bucket we provide are kept for the 90 days and then deleted from it, once no S3 Object Lock retention prevents it. After the 90 days we delete the records we hold about your backups, including their encryption keys, and confirm the deletion in writing on request. Copies in our encrypted database backups are gone within 90 days after those records are deleted; after that, backups left in a bucket can no longer be decrypted. We keep the audit trail and support tickets, keep our invoices, contracts, and billing and distributor records for the period the law requires, and keep a tenant's records while a legal hold applies. We never remove an S3 Object Lock retention, but a bucket owner who holds the permission to bypass a governance-mode retention can. Your signed agreement sets the binding terms.

Fill out the Get Started form on our website. Our team will contact you within one business day to set up your account, configure your Microsoft 365 connector, and onboard your first tenants.

Prices and invoices are in US dollars. Card payments are processed by Peach Payments in South African rand (ZAR) at the exchange rate shown at checkout, and your card issuer may apply currency-conversion or foreign-transaction fees. Prices exclude any applicable sales, use or similar taxes. Every invoice we send a partner includes a payment processing fee of 3.5% of the invoice total, on its own line, however the invoice is paid; invoices to direct customers do not.

Storage includes all backup snapshots across Exchange, OneDrive, SharePoint, and Teams. Content-addressable deduplication is applied before calculating usage. Backups are written to your own S3 bucket, where your storage provider bills you directly, or, for direct customers, to a bucket we provide; either way VaultFuzion bills no per-GB storage or overage.

Kapsul8 commitment discounts are 10% (1-year), 18% (3-year) and 25% (5-year), taking the Scale-band rate from $0.99 to $0.89, $0.81 and $0.74. VentraID carries its own ladder, 15%, 25% and 35% on the same terms.

Enterprise is custom-quoted per deal with a negotiated committed minimum. Below Enterprise the published bands apply: Starter 1-9 seats, Growth 10-99, Scale 100-999, Volume 1,000+. Your committed seat count is simply the floor of your band - 1 seat on Starter, 10 on Growth, 100 on Scale, 1,000 on Volume - so there is no seat minimum to get started. The commitment is a billing floor, not a feature gate: every band runs identical software.

Every backup is encrypted at rest with AES-256-GCM under a per-tenant key. All audit events are chained with SHA-256 for tamper evidence. The platform is engineered to support the retention, disposition, and evidence-grade requirements of common data-protection frameworks. We are not currently holding SOC 2 or ISO 27001 certification; specific regulatory commitments are addressed in your signed agreement.

Yes. A partner administrator switches white-label branding on in the Partner Portal, and the Tenant Control Center then carries your logo and brand colours, so your clients see your brand rather than VaultFuzion's. It is a monthly add-on for your partner account, included with Enterprise.

Exchange Online (mail, calendar, contacts, and the archive folder), OneDrive for Business (files and permissions), SharePoint Online (document libraries, custom lists, pages, and subsites), and Microsoft Teams (channel messages and files, plus 1:1, group and meeting chats). Microsoft 365 Groups conversations and Planner are included as well. Microsoft Entra ID (Azure AD) is protected separately through the VentraID add-on. Two honest caveats. First, VaultFuzion does not restore Teams chats, Microsoft 365 Groups conversations or Planner back into Microsoft 365: Groups conversations and Planner are browsable and eDiscovery-exportable, while Teams 1:1, group and meeting chats are captured in the backup but not yet browsable or exportable in the portals. Second, Teams chats hosted in another organisation’s tenant — external meeting threads — cannot be captured by a tenant-scoped connector; the backup logs them as out of scope rather than skipping them silently.

Microsoft 365 backs up three times a day by default, an eight-hour recovery point, and is configurable up to six times a day for a four-hour one. VentraID defaults to three times a day, configurable up to six times a day. Our Recovery Time Objective (RTO) target is four hours for a critical individual item, from the restore request (for a direct customer, whose restores we run, four business hours from when we receive the request). Larger restores, including a full mailbox or a whole tenant, depend on data volume and Microsoft 365 throttling and have no fixed target. RPO/RTO targets are defined contractually in your subscription agreement and are targets, not guarantees.

Retention is configurable up to 7 years, with automated disposition when a window expires. Objects under a legal hold are exempt until the hold is released, a disposition run cannot remove them.

Not from inside your Microsoft 365 tenant. Your backups live on independent storage outside that tenant, so stolen Microsoft admin credentials give an attacker no path to them. Backups are written to an S3-compatible bucket: your own, or, for direct customers, a bucket VaultFuzion provides. When that bucket has S3 Object Lock enabled, the backup content and manifests of each restore point are locked for the tenant’s lock window: 30 days to 7 years, or at least 30 days in governance mode for a direct customer. In compliance mode nobody, including VaultFuzion, can shorten or remove the lock before it expires; in governance mode only a principal you have explicitly granted the bypass permission can. Items kept only as records (calendar events, contacts, Groups conversations, Planner, and SharePoint list items and pages) and each backup’s item listings are written without a lock; a change to any of them is detectable against the signed backup manifest.

Yes, through the dedicated VentraID add-on. VentraID Backup captures users, groups, conditional access policies, named locations, service principals, directory roles, devices, and authentication-method policies on a snapshot cadence. Higher VentraID tiers add drift detection, multi-framework compliance scoring, conditional-access What-If, and identity threat detection. Sign-in-based threat detectors need Microsoft Entra ID P1 or P2.

Not in the sense most people mean. Microsoft operates a shared responsibility model: they guarantee the availability of the service and the infrastructure, and you remain responsible for your data within it. Microsoft 365 does have native recovery mechanisms and they are genuinely useful - items sit in a recycle bin, deleted mailboxes and sites are retained for a period, and retention policies can hold content in place. Microsoft also offers Microsoft 365 Backup, a separately billed service; its backups are append-only rather than deletion-proof, and they stay inside your tenant's Microsoft data boundary and geo. The native mechanisms are time-boxed and designed to recover from ordinary mistakes, not to act as a long-horizon independent copy. Once a native retention window elapses the data is gone, and a retention policy is a hold on live data rather than a separate copy. The practical test: could you restore a specific mailbox to a specific point in time, six months after the fact, on your own timetable, from a copy held outside your tenant? Microsoft 365 Backup behaviour verified against Microsoft documentation on 29/09/2026.

Sometimes not, and we would rather say so than oversell. Microsoft Entra Backup and Recovery is generally available, on by default, and takes a daily backup that not even a Global Administrator can delete - a genuinely strong guarantee. If you are protecting a single P1 or P2 workforce tenant against a change somebody notices within the week, it is likely sufficient. The limits Microsoft states itself are where an independent copy still earns its place: retention is up to seven days; backup data resides in the same geo-location as the tenant it protects, so it shares that tenant’s fate; hard-deleted objects are explicitly out of scope; External ID and Azure AD B2C tenants are not supported; and for objects mastered in on-premises Active Directory, Microsoft directs you to use an alternative solution. Microsoft’s own guidance is to treat it as part of a broader approach to recoverability, and we agree with that framing. Verified against Microsoft documentation on 29/09/2026 - they revise this product often, so check the current pages before deciding either way.

In an S3-compatible bucket: your own, or, for direct customers, a bucket VaultFuzion provides. Bring your own and backups are written to a bucket in your own cloud account, with your storage provider billing you directly, so your backups never become hostage to a billing dispute with a backup vendor and capacity planning and retention cost stay yours to control. Buying direct and prefer not to run a bucket? We can provide one: we tell you where it is located on request, bill it at our documented cost with no margin, and back up to it only while it passes our storage test, which requires S3 Object Lock. Either way there is no per-seat storage allowance to exhaust and no storage overage payable to us.

Retention templates for HIPAA, SOX and GDPR windows ship with the platform, alongside per-tenant encryption, a SHA-256 audit chain, automated disposition and destruction certificates. To be direct about the difference between support and certification: we are not currently SOC 2 or ISO 27001 certified, and we do not claim GDPR or CCPA compliance. What we provide is the technical substrate and the evidence trail; the commitments that bind us, and any specific requirements, are addressed in your signed agreement.

Every tenant's backup data is encrypted with AES-256-GCM. Each tenant has its own data encryption key, held encrypted under a platform master key, meaning a misrouted restore fails at the cryptographic layer, not at an application policy check. We never store raw card data; payment processing is delegated to Peach Payments.

Every sensitive operation (backup, restore, retention apply, purge, legal hold change, key rotation) is recorded as an audit block, and each block carries the SHA-256 hash of the block before it. That chain catches two kinds of tampering on its own: alter one block and it fails its own recomputation — rechecked hourly over the newest blocks and again in a full daily sweep; delete one and the same sweep finds the reference that no longer resolves. It does not catch the third. An attacker who can rewrite a block can recompute every hash after it, and the result verifies perfectly — no hash chain catches that, ours or anyone’s — which is why each chain’s head is also anchored and signed. Every chain’s head is anchored nightly and signed with an Ed25519 key held outside the database, so a rewrite-and-re-chain no longer matches a head that was already signed. Anchors are written forward only and never back-filled. Ask us for the public key and your anchor records and you can check them independently of us. The chain is a tamper-evident platform record; what you put in front of a regulator, an auditor or a court remains your decision.

VaultFuzion enforces MSP isolation at three layers: (1) MSPOwnershipGuard blocks cross-MSP requests at the controller level; (2) Tier-1 services (Restore, Backup, Evidence, M365) re-validate tenant.mspId at the service level for defence-in-depth; (3) cross-MSP tenant lookups return HTTP 404 (not 403) to prevent existence disclosure. VaultFuzion staff can access tenants for support and operations, and every time staff sign in to a tenant's portal on its behalf, that session is recorded in the audit trail.

No. Kapsul8 Microsoft 365 backup and VentraID Entra ID backup and recovery have no onboarding fee, no setup fee and no activation charge — not for your MSP, and not for any tenant you bring on. A client tenant carries no one-time charges at all; ongoing cost is the published subscription rate (plus the 3.5% payment processing fee on invoices to partners), plus whatever your storage provider charges you for a bucket you bring.

We aim to take an MSP from contract signature to its first protected tenant within 1-2 business days: Microsoft 365 consent, Partner Portal access and the first tenant's configuration take hours. The first full backup depends on tenant size and Microsoft Graph throttling; for a 100-seat tenant, plan for 24-72 hours.

Email support is included on every seat band. Requests, by email or as a ticket in the Tenant Control Center or the Partner Portal, carry a first-response target set by their severity and your seat band (a direct customer has the Starter targets, under which feature requests have no target), measured in business hours: Monday to Friday, 08:00–17:00 US Eastern, excluding US federal holidays. Support language: English. The response targets and escalation procedures that bind us are set out in your signed agreement.

Yes. The Migration Wizard in the Partner Portal moves each client onto VaultFuzion from Microsoft 365 itself: it creates the tenant, applies your retention, sends the Microsoft 365 admin-consent link and runs the first backup. VaultFuzion does not import another provider's backup history, so the usual approach is to keep that service read-only until its retention runs out while VaultFuzion builds new history.