Kapsul8 EndpointBackup · Live in production
Backup for Windows endpoints.
Built for the MSP channel.
Desktops, laptops, and servers, all protected by one engine, in your VaultFuzionPartner Portal. Per-device pricing. Bring your own storage, in your own region.
Tiered for every tenant.
MSP wholesale pricing in US Dollars. Resale margin is yours to set.
Commitment period
12-month commitment with 5% off list. Standard MSP partner term.
Pro-Accelerator Add-On
Sub-hourly cadence.
Faster restores.
Faster restores.
SERVERS
Pro-Accelerator is included by default on every Pro server endpoint. Hourly image cadence, application-consistent backup, target RTO ~1–2 hr on standard server hardware (a target, not a guarantee; actual recovery time depends on data volume and your network).
WORKSTATIONS
Optional one-time per-workstation add-on. No monthly upcharge. Recommended for executive laptops, design workstations, and high-delta development machines where intra-day restore points matter.
All prices in US Dollars (USD), exclusive of local taxes. MSP wholesale pricing, resale margin is yours to set. Storage is BYOS (Bring-Your-Own-Storage), configurable to any S3-compatible storage backend you choose. The customer pays their chosen storage provider directly. No storage pool, no per-GB overage from VaultFuzion. Minimum endpoint commitments apply per tier as shown on each card. A one-time MSP onboarding fee applies when you first partner with us — charged once, not per tenant. Onboarding additional client tenants afterwards carries no tenant onboarding fee — only a one-time setup charge for any servers that tenant brings on. For complete pricing terms, commitment-period mechanics, and forward-pricing policy, see our Terms of Use and Fair Usage Policy.
Onboarding
What your onboarding fee covers — once.
Onboarding is a one-time engagement with your MSP, charged once and never again. Every tenant you bring on afterwards is provisioned to exactly this same standard at no tenant onboarding fee — you pay only a one-time setup charge for any servers that tenant brings into scope. The steps below are what that provisioning covers, on every tenant, for the life of the partnership.
01
Dedicated tenant provisioning
Each tenant gets dedicated, isolated infrastructure, its own backup container, hardened OS, LUKS-encrypted disk, a dedicated S3 bucket on your chosen storage backend, application-enforced legal hold with a tamper-evident audit trail, and a per-tenant AES-256 encryption key encrypted under the VaultFuzion master key.
02
Rebranded agent + deployment pipeline
Windows MSI installer rebranded for your brand, NinjaOne (or your RMM of choice) deploy script generated, enrollment tokens issued for each endpoint.
03
Pro-Accelerator activation (servers + opt-in workstations)
Pro-Accelerator is activated by default on every Pro server endpoint and is available as an optional one-time add-on per workstation. This unlocks sub-hourly image cadence, application-consistent capture, and faster restore times. Server activation is covered by the one-time server setup fee charged when that tenant is onboarded.
04
Restore-drill validation
Before production handover, a documented restore drill on a sample set of endpoints confirms the chain works end-to-end. Sign-off is in writing.
One onboarding fee, for you — not for each client. The onboarding fee is charged once, when your MSP first partners with us. Bringing your second, tenth or fiftieth client tenant onto the platform carries no tenant onboarding fee. Every tenant still gets dedicated, isolated infrastructure — its own container, its own storage bucket, its own encryption passphrase, never shared with another customer — and that per-tenant stand-up is carried by the subscription, not re-charged as a second onboarding fee.
The one exception is servers. Where a new tenant brings servers into scope, a one-time server setup fee covers Pro-Accelerator provisioning for those servers — image-based, application-consistent capture has to be stood up per server. It is a materially smaller figure than the MSP onboarding fee, it scales with the number of servers rather than the size of the tenant, and a tenant that brings no servers pays nothing at setup. Tenants arriving purely for Kapsul8 Microsoft 365 backup or VentraID have no onboarding or setup charge whatsoever. Talk to your VaultFuzion partner manager for an exact quote.
And billing waits on a successful restore drill. For each tenant, monthly per-endpoint billing begins only once a restore-drill validation report is countersigned by both your technical lead and ours. You are not paying for a promise.
The one exception is servers. Where a new tenant brings servers into scope, a one-time server setup fee covers Pro-Accelerator provisioning for those servers — image-based, application-consistent capture has to be stood up per server. It is a materially smaller figure than the MSP onboarding fee, it scales with the number of servers rather than the size of the tenant, and a tenant that brings no servers pays nothing at setup. Tenants arriving purely for Kapsul8 Microsoft 365 backup or VentraID have no onboarding or setup charge whatsoever. Talk to your VaultFuzion partner manager for an exact quote.
And billing waits on a successful restore drill. For each tenant, monthly per-endpoint billing begins only once a restore-drill validation report is countersigned by both your technical lead and ours. You are not paying for a promise.
What every tier ships with
Windows agent
MSI deployable via NinjaOne, Intune, or GPO.
Your storage, your region
BYOS to any S3-compatible backend, with application-enforced legal hold and a tamper-evident audit trail. Optional court-grade WORM via held-backup export to an Object-Lock bucket. Choose a provider in whichever region your client requires.
Single console
VaultFuzion Partner Portal, manage your entire portfolio in one place.
One invoice
Every client on one monthly invoice, with the per-tenant breakdown behind it.
AES-256-GCM encryption
A separate encryption key per tenant, encrypted under the VaultFuzion master key.
Publisher-signed binaries
All 60 executables and libraries in the agent payload carry a valid Authenticode signature, RFC 3161 timestamped so they stay verifiable after the signing certificate expires: the backup engine under the engine vendor's Extended Validation certificate, the Microsoft C++ runtime and Windows API-set components by Microsoft. The deployment script itself is not signed. Supports publisher-based allowlisting in WDAC and AppLocker — publisher identity and a verification script ship in the EDR pre-flight pack.
Audit chain
SHA-256 hash-chained event log for forensic defensibility.
Encrypted in transit and at rest
Snapshots are encrypted with the tenant key.
NinjaOne compatible
Your existing RMM stays in place. We integrate cleanly.
Important Disclosures
- •Initial scope is Windows 10, Windows 11, and Windows Server 2016/2019/2022. macOS and Linux endpoints are NOT supported in current tiers.
- •Endpoint Backup protects on-premises Windows machines. Microsoft 365 cloud data, Exchange Online mailboxes, SharePoint Online, OneDrive for Business, and Teams channels, requires Kapsul8 M365 Pro Backup, a separate product. Locally-synced OneDrive files captured by Endpoint Backup do not substitute for cloud-side M365 protection.
- •Base runs a daily backup. Pro adds hourly image backup on servers (Pro-Accelerator included by default) and optional sub-hourly capture on workstations via the Pro-Accelerator add-on. Continuous data protection (15-min RPO) is an Elite-tier feature, available Q2 2027.
- •Manual restore from any prior snapshot is included in every tier. Automatic agent-driven ransomware rollback is Elite-tier only and available Q2 2027.
- •Elite-tier features are roadmap and not contractually guaranteed by current tiers. Tier upgrade from Pro to Elite will require a new agreement at the published Elite rate.
- •Recovery times depend on data volume and customer network bandwidth. Initial backup seed for large estates (>10 TB) may benefit from a physical seed option, discuss with your partner manager.
Ready to protect your fleet?
Talk to us about onboarding Kapsul8 EndpointBackup for your tenants.