Frequently Asked QuestionsFrequently Asked Questions

A seat is one licensed Microsoft 365 user mailbox (USER_MAILBOX type). Shared mailboxes, room mailboxes, and equipment mailboxes are not counted. Active seats (protected, discovered, or paused) are billed at full rate — pausing a mailbox does not archive it. Archived seats, where the mailbox is no longer found in Microsoft 365 but its backup data is retained, are billed at 50% of the per-seat rate. Billing uses the current active and archived seat counts for the period, with your band’s committed-seat floor where one applies.

Archived seats are mailboxes that are no longer found in Microsoft 365 — typically because the user has left the organisation — whose historical backup data is retained for compliance or legal hold purposes. Pausing a mailbox does not archive it; a paused seat still bills at the full rate. Archived seats are billed at 50% of the active per-seat rate across all subscription tiers. They do not count toward per-seat add-on charges.

Band upgrades take effect immediately and are pro-rated for the remaining days in your billing period. Downgrades are processed by your VaultFuzion account manager at the end of the billing cycle. Your feature set is unchanged either way, the band sets your committed seat count and per-seat rate, not what the software does.

Upon cancellation, your data is available for export for 30 days. After that, it's securely deleted with SHA-256 destruction certificates issued as proof of deletion, in compliance with POPIA requirements.

Fill out the Get Started form on our website. Our team will contact you within 24 hours to set up your account, configure your M365 connector, and onboard your first tenants.

We process payments through Peach Payments, supporting credit and debit cards and EFT/bank transfer. South African customers are billed in ZAR with 15% VAT applied. Every invoice we send a partner includes a payment processing fee of 3.5% of the invoice total, on its own line, however the invoice is paid; invoices to direct customers do not.

Storage includes all backup snapshots across Exchange, OneDrive, SharePoint, and Teams. Content-addressable deduplication is applied before calculating usage, so you are billed on the deduplicated footprint rather than the raw estate. Overage is billed at R1/GB/month.

Kapsul8 commitment discounts are 10% (1-year), 18% (3-year), and 25% (5-year). Entra ID add-ons (VentraID) carry a steeper ladder, 15% (1-year), 25% (3-year), and 35% (5-year) commitment discounts.

Enterprise is custom-quoted in ZAR with a negotiated committed seat minimum. Below Enterprise the published bands apply: Starter 1-9 seats, Growth 10-99, Scale 100-999, Volume 1,000+. Your committed seat count is simply the floor of your band - 1 seat on Starter, 10 on Growth, 100 on Scale, 1,000 on Volume - so there is no separate seat minimum to get started. The commitment is a billing floor, not a feature gate: every band runs identical software. Contact our sales team for an Enterprise quote.

Yes, the platform is engineered to support your POPIA programme. Per-tenant encryption keys, configurable retention periods up to 7 years, automated disposition workflows, destruction certificates, and a tamper-evident SHA-256 audit chain are all included by default. POPIA compliance remains your responsibility as the responsible party; we provide the tooling and evidence trail to make that ongoing work auditable.

Yes. A partner administrator switches white-label branding on in the Partner Portal, and the Tenant Control Center then carries your logo and brand colours, so your clients see your brand rather than VaultFuzion’s. It is a monthly add-on available on any band, included with Enterprise.

Exchange Online (mail, calendar, contacts, and the archive folder), OneDrive for Business (files and permissions), SharePoint Online (document libraries, custom lists, pages, and subsites), and Microsoft Teams (channel messages and files, plus 1:1, group and meeting chats). Microsoft 365 Groups conversations and Planner are included as well. Microsoft Entra ID (Azure AD) is protected separately through the VentraID add-on. Two honest caveats. First, VaultFuzion does not restore Teams chats, Microsoft 365 Groups conversations or Planner back into Microsoft 365: Groups conversations and Planner are browsable and eDiscovery-exportable, while Teams 1:1, group and meeting chats are captured in the backup but not yet browsable or exportable in the portals. Second, Teams chats hosted in another organisation’s tenant — external meeting threads — cannot be captured by a tenant-scoped connector; the backup logs them as out of scope rather than skipping them silently.

Microsoft 365 backs up three times a day by default, an eight-hour recovery point, and is configurable up to six times a day for a four-hour one. VentraID defaults to three times a day, configurable up to six times a day. Our Recovery Time Objective (RTO) target is four hours for a critical individual item, from the restore request. Larger restores, including a full mailbox or a whole tenant, depend on data volume and Microsoft 365 throttling and have no fixed target. RPO/RTO targets are defined contractually in your subscription agreement and are targets, not guarantees.

Retention is configurable up to 7 years across every band, with automated disposition when a window expires. Legal-hold-attached objects are exempt from disposition until the hold is released.

Not from inside your Microsoft 365 tenant. Your backups live on independent storage outside that tenant, so stolen Microsoft admin credentials give an attacker no path to them. Backups are written to write-once storage under S3 Object Lock in compliance mode: once a restore point is locked, it can’t be altered or deleted by anyone — not a rogue administrator, not VaultFuzion — until the retention period you set, from 30 days to 7 years, lawfully expires. Destruction happens only after that lawful expiry, with SHA-256 destruction certificates issued as proof, in line with POPIA.

Yes, through the dedicated VentraID add-on. VentraID Backup captures users, groups, conditional access policies, named locations, service principals, directory roles, devices, and authentication-method policies on a snapshot cadence. Higher VentraID tiers add drift detection, multi-framework compliance scoring, conditional-access What-If, and identity threat detection.

Not in the sense most people mean. Microsoft operates a shared responsibility model: they guarantee the availability of the service and the infrastructure, and you remain responsible for your data within it. Microsoft 365 does have native recovery mechanisms and they are genuinely useful - items sit in a recycle bin, deleted mailboxes and sites are retained for a period, and retention policies can hold content in place. But those are time-boxed and designed to recover from ordinary mistakes, not to act as a long-horizon independent copy. Once a native retention window elapses the data is gone, and a retention policy is a hold on live data rather than a separate copy you control. The practical test: could you restore a specific mailbox to a specific point in time, six months after the fact, on your own timetable, into storage you control?

Sometimes not, and we would rather say so than oversell. Microsoft Entra Backup and Recovery is generally available, on by default, and takes a daily backup that not even a Global Administrator can delete - a genuinely strong guarantee. If you are protecting a single P1 or P2 workforce tenant against a change somebody notices within the week, it is likely sufficient. The limits Microsoft states itself are where an independent copy still earns its place: retention is up to seven days; backup data resides in the same geo-location as the tenant it protects, so it shares that tenant’s fate; hard-deleted objects are explicitly out of scope; External ID and Azure AD B2C tenants are not supported; and for objects mastered in on-premises Active Directory, Microsoft directs you to use an alternative solution. Microsoft’s own guidance is to treat it as part of a broader approach to recoverability, and we agree with that framing. Verified against Microsoft documentation on 15/08/2026 - they revise this product often, so check the current pages before deciding either way.

Section 19 of POPIA requires the responsible party to secure the integrity and confidentiality of personal information through appropriate, reasonable technical and organisational measures. VaultFuzion supports Section 19 compliance through per-tenant AES-256-GCM encryption, hash-chained audit trails, content-addressable storage, and restricted operator access through MSP isolation. Section 19 compliance remains your responsibility as responsible party, we provide the technical substrate.

Section 22 requires the responsible party to notify the Information Regulator and affected data subjects of a security compromise. VaultFuzion's tamper-evident audit chain records what data was accessed, when, and by whom, which is the foundation for any Section 22 notification. The Partner Portal lists destruction certificates and will re-verify any certificate's hash on demand; per-object integrity status and audit-chain verification are available over the API for your own tenants, documented on request; and the audit trail is queryable and exportable — so a notification can be drafted and substantiated from the record rather than from recollection.

Section 109 governs personal-information destruction following the lawful retention period. VaultFuzion issues SHA-256-sealed destruction certificates on object-level disposition and crypto-shred, with the certificate hash chained into the audit trail. The certificate records the object identifiers, the encryption-key destruction status and the destruction timestamp, giving the responsible party a tamper-evident record of what was disposed of, how and when. It is a platform record, not a legal determination: your Information Officer decides what to put before the Regulator.

South African customer data is stored in South African Microsoft Azure regions and Z1Storage facilities in Johannesburg by default. SA data residency is contractually committed in your subscription agreement. International customers may opt for alternate residency through their signed Master Services Agreement.

You as the responsible party must register an Information Officer with the Information Regulator under POPIA, VaultFuzion does not register one on your behalf. Synchplus Consulting (Pty) Ltd has designated an Information Officer for VaultFuzion-platform processing; registration with the Information Regulator is in progress. Our Privacy Policy lists the Information Officer contact for VaultFuzion-internal data-subject requests.

The A-F compliance grade is VaultFuzion's internal scoring across 13 platform-level POPIA checks (Sections 19, 22, 109, retention, audit-chain integrity, encryption posture, etc.). It is operational scoring, not a regulatory verdict from the Information Regulator. The grade surfaces as a card on every tenant dashboard, with portfolio-distribution views for MSPs and platform-wide histograms for VaultFuzion staff.

Veeam sells both self-managed backup software and a hosted service (Veeam Data Cloud). VaultFuzion is a cloud-native MSP-first platform with per-tenant encryption keys, hash-chained tamper-evident audit, content-addressable deduplication, point-in-time restore across all four M365 workloads, and an integrated POPIA compliance engine. We also bundle identity protection (VentraID) and eDiscovery with legal holds (EvidenceVault) in one subscription. Multi-tenant MSP isolation is native, not bolted on. Comparison reflects published capabilities as of 14/08/2026.

AvePoint is a long-established player. VaultFuzion differentiates on evidence-grade audit (SHA-256 hash chain), per-tenant encryption keys (another tenant’s at-rest data can never be read; cross-tenant restore is a supported, MSP-fenced operation that re-encrypts the data under the destination tenant’s own key), POPIA-aligned retention engine with destruction certificates, and bundled adjacent products (identity protection and eDiscovery). For South African MSPs, ZAR-native billing through PayI and SA data residency are core to how we are built. Compare current published capabilities directly (checked 14/08/2026).

Datto SaaS Protection covers Exchange, OneDrive, SharePoint and Teams (as of 14/08/2026, per Datto's published product page). VaultFuzion covers the same four workloads and adds identity-plane protection through VentraID and a POPIA-aligned retention engine with destruction certificates, on one subscription. Compare current published capabilities and pricing directly — both products change often.

Every tenant's backup data is encrypted with AES-256-GCM. Each tenant has its own data encryption key, held encrypted under a platform master key, meaning a misrouted restore fails at the cryptographic layer, not at an application policy check. The platform master key is held as a secret in a managed key vault. We never store raw card data, payment processing is delegated to Peach Payments.

Every sensitive operation (backup, restore, retention apply, purge, legal hold change, key rotation) is recorded as an audit block, and each block carries the SHA-256 hash of the block before it. That chain catches two kinds of tampering on its own: alter one block and it fails its own recomputation — rechecked hourly over the newest blocks and again in a full daily sweep; delete one and the same sweep finds the reference that no longer resolves. It does not catch the third. An attacker who can rewrite a block can recompute every hash after it, and the result verifies perfectly — no hash chain catches that, ours or anyone’s — which is why each chain’s head is also anchored and signed. Every chain’s head is anchored nightly and signed with an Ed25519 key held outside the database, so a rewrite-and-re-chain no longer matches a head that was already signed. Anchors are written forward only and never back-filled. Ask us for the public key and your anchor records and you can check them independently of us. The chain is a tamper-evident platform record; what goes before a regulator remains your Information Officer’s decision.

VaultFuzion enforces MSP isolation at three layers: (1) MSPOwnershipGuard blocks cross-MSP requests at the controller level; (2) Tier-1 services (Restore, Backup, Evidence, M365) re-validate tenant.mspId at the service level for defence-in-depth; (3) cross-MSP tenant lookups return HTTP 404 (not 403) to prevent existence disclosure. VaultFuzion staff retain access for support and operations under documented break-glass procedures.

No. Kapsul8 Microsoft 365 backup and VentraID Entra ID protection have no onboarding fee, no setup fee and no activation charge — not for your MSP, and not for any tenant you bring on. A client tenant arriving purely for Microsoft 365 backup or Entra ID protection carries no one-time charges at all; ongoing cost is the published subscription rate plus any storage overage under the Fair Usage Policy. There are no one-time charges on either product.

We aim to take an MSP from contract signature to its first protected tenant within 1-2 business days: Microsoft 365 consent, Partner Portal access and the first tenant's configuration take hours. The first full backup depends on tenant size and Microsoft Graph throttling; for a 100-seat tenant, plan for 24-72 hours.

Email support is included on every seat band. Growth and above receive priority support with 4-hour first-response targets during business hours. Scale and Volume include dedicated account management. Enterprise customers receive 24/7 support with named technical contact. Support languages: English. Support escalation procedures are documented in your subscription agreement.

Yes. The Migration Wizard in the Partner Portal moves each client onto VaultFuzion from Microsoft 365 itself: it creates the tenant, applies your retention, sends the Microsoft 365 admin-consent link and runs the first backup. VaultFuzion does not import another provider's backup history, so the usual approach is to keep that service read-only until its retention runs out while VaultFuzion builds new history.