VaultFuzionVaultFuzionBY KAPARDYN
Kapsul8 · Backup & Recovery

Two ways in. One sealed vault. Every way back.

Kapsul8 is one evidence-grade engine with two intakes: an agentless Microsoft Graph connection for M365, and a lightweight agent for Windows fleets. Everything is deduplicated, sealed with per-tenant keys, and proven on a hash-chained audit trail.

MICROSOFT 365EXCHANGEONEDRIVESHAREPOINTTEAMSAGENTLESS · GRAPH APIWINDOWS FLEETDESKTOPSLAPTOPSSERVERSAGENT ON EVERY MACHINEGRAPH DELTA SYNConly changes movecursor survives throttlingAGENT SNAPSHOTVSS-consistent snapshotsfile daily · image hourlyKAPSUL8 ENGINEDEDUPLICATEidentical data stored onceENCRYPTAES-256 · one key per tenantHASH-CHAINevery operation, tamper-evidentSEALED CAPSULESA storage · or BYOSretention 30d – 7yDESTRUCTION-CERTIFIEDRESTORE · 6 ENDPOINT MODES · ITEM-LEVEL PIT ON M365
Microsoft 365

Exchange · OneDrive · SharePoint · Teams — agentless Graph delta sync

Windows fleet

Desktops, laptops, servers — agent snapshots, file daily + image hourly (VSS)

↓
Kapsul8 engine

Deduplicate → encrypt (per-tenant AES-256) → hash-chain every operation

↓
Sealed capsule

SA storage or BYOS · retention 30d–7y · destruction-certified

↩ Restore — 6 endpoint modes · item-level PIT on M365
How they operate

Two products. Not two bolt-ons.

Each stands on its own — different intake, different unit, different tiers. Start with either, add the other any time. One console and one invoice either way.

One engine underneath

Whatever the intake, the data walks the same four steps.

01
Capture

Graph delta sync on the cloud side; VSS-consistent file and image snapshots on the machine side. Only changes move.

02
Reduce

Content-addressable storage: identical data across users and machines is stored exactly once — 40–60% typical savings.

03
Seal

AES-256 with a separate key per tenant, at rest in South Africa by default — or in your own S3 bucket with BYOS.

04
Prove

Every backup, restore, and retention action lands on a SHA-256 hash chain; disposal ends with a destruction certificate.

Kapsul8 M365 Backup

The cloud intake — agentless and delta-first.

Four workloads captured from one engine, restored with item-level precision. Cursor persistence means the sync survives Graph API throttling and outages without starting over.

WorkloadWhat's capturedHow it restores
Exchange Online

Full mailboxes with delta sync — after the first full backup, only changes move.

A single mail item or the whole mailbox, to any retained point in time.

OneDrive

Per-user drives with file version history — personal and shared drives.

Granular file restore from any retained version.

SharePoint

Site collections including documents, lists, permissions, and metadata.

Selective restore down to the sub-site.

Microsoft Teams

Channel messages, files, tabs, and meeting transcripts — private and shared channels included.

Point-in-time recovery through approval-based workflows.

Item-level restorePoint-in-timeApproval-based workflowsVersion historyExplore M365 Backup →
Kapsul8 EndpointBackup

The machine intake — from daily files to bare metal.

Two backup types feed the vault, and six restore modes come back out. BitLocker-aware, BYOS-ready, priced per endpoint in ZAR.

Backup type A
File backup — daily

Every workstation and laptop, daily. System state rides along in the file backup with app-aware writers: Active Directory, SQL Server, Exchange Server, IIS, Hyper-V.

Backup type B
Image backup — hourly on servers

Full-disk images with Pro-Accelerator built into the Pro tier — the backup type that makes bare-metal recovery and restore-to-VM possible.

Six ways back.

Two backup types, six restore modes — pick by what broke, not by what the tool supports.

File / folder

Pull back a file, a folder, or a whole tree.

System state

Guided recovery of Registry, Task Scheduler, and COM+ writers.

Point-in-time

Browse snapshots by calendar day and restore from any of them.

Cross-endpoint

Restore one machine's data onto a different machine.

Bare-metal (BMR)

Rebuild a dead machine completely from its image backup.

Restore-to-VM

Stand the machine up as a virtual machine while hardware is replaced.

Base

Workstations and laptops · daily file backup · 30-day retention

→
Pro

Servers join · hourly images with Pro-Accelerator · all six restore modes

→
Elite

15-minute CDP · ransomware detection + rollback · restore-as-VM · Coming Q3 2026

2
Intakes — agentless cloud + endpoint agent
4
M365 workloads from one engine
6
Endpoint restore modes
40–60%
Typical dedup storage savings
7 yr
Maximum POPIA retention, certified disposal
Pricing

Per seat on the cloud side. Per endpoint on the machine side.

M365 Backup ships in every VaultFuzion tier — Starter, Backup Pro, Pro-Heavy, Fortress. EndpointBackup is priced per endpoint in ZAR across Base, Pro, and Elite.

FAQ

Frequently asked questions.

No. M365 Backup is agentless — it connects to the tenant through Microsoft Graph with an admin consent flow. Delta sync then captures Exchange, OneDrive, SharePoint, and Teams on schedule; after the first full backup, only changed data moves.

A lightweight agent on each Windows machine takes VSS-consistent snapshots — daily file backups on workstations, hourly full-disk images on servers with Pro-Accelerator — and pushes them into a vault provisioned for that tenant alone. Workstations, laptops, and Windows Server 2016–2022 are covered.

They are independent products. Run M365 Backup alone, EndpointBackup alone, or both together — either way you get one console and one invoice, and the same engine underneath: dedup, per-tenant AES-256, and the hash-chained audit trail.

In South African object storage by default, or in your own S3-compatible bucket with BYOS. Every tenant is encrypted with its own AES-256 key, retention runs from 30 days to 7 years under the POPIA engine, and disposal ends with a SHA-256 destruction certificate.

See both intakes running against your own estate.

Tell us about your MSP and we will configure your tenant and partner-portal access within one business day.