VaultFuzion security and trust

Backups are encrypted with AES-256-GCM, and the key is unique to each tenant. Tenant keys are randomly generated and wrapped by a managed key store rather than shared or reused, so one tenant’s key can never decrypt another’s data. The platform master key lives as a secret in a managed key vault — not in application code, not in a config file. The practical effect: a key compromise is bounded to a single tenant, by construction.

“Immutable” is a precise property here, not an adjective. Backups are written under compliance-mode object lock (WORM): once an object is written, it cannot be altered or deleted by anyone — not an attacker, not an administrator, not the vendor, not the root account — until its retention period expires. That is the distinction that matters after a ransomware engagement, where the threat model includes a privileged account: governance-mode locks can be bypassed by whoever holds the bypass permission, and compliance-mode locks cannot. This is enforced by S3 Object Lock on the storage bucket — on bring-your-own-storage, a bucket you enable for Object Lock; on a VaultFuzion-provided bucket, on by default.

Every backup, restore, retention and disposition action is written to a hash-chained audit ledger. Each record carries the hash of the record before it, so changing any entry invalidates verification of every entry after it — tampering is not prevented by hope, it is detectable by math. The trail is queryable and exportable when a regulator, an auditor or an incident review asks what happened, when, and by whom.

Data is isolated per tenant, each with its own encryption key, so a problem in one tenant stays in one tenant. Access is scoped to the managing MSP: the platform enforces partner boundaries so one MSP cannot see or reach another MSP’s tenants. Multi-tenancy is the starting point of the design, not a feature bolted on afterwards.

VaultFuzion is bring-your-own-storage: backups are written to your own S3-compatible bucket, in the cloud account and region you choose. You own the data and the egress, and you place it where your obligations require — US privacy frameworks such as HIPAA and GLBA impose security and handling duties rather than a blanket US-residency mandate, and BYOS lets you satisfy whichever ones apply. Direct customers who prefer not to run storage can use a bucket VaultFuzion provides, billed at cost.

SOC 2 Type II is on our roadmap. Rather than point at a badge, we describe the controls we run today — per-tenant encryption, compliance-mode immutability, a tamper-evident audit trail and tenant isolation — and we do not claim a certification we have not yet earned. As attestations are completed, this page is where they will appear.