Question 1

What counts as a "seat"?

Accepted Answer

A seat is one licensed Microsoft 365 user mailbox (USER_MAILBOX type). Shared mailboxes, room mailboxes, and equipment mailboxes are not counted. Active seats (protected, discovered, or paused) are billed at full rate. Archived seats — where backup data is retained but active protection is paused — are billed at 50% of the per-seat rate. Billing is based on the peak seat count during the billing period to prevent end-of-month adjustments.

Question 2

What are archived seats?

Accepted Answer

Archived seats are mailboxes where the user has left the organisation or backup has been paused, but historical backup data is retained for compliance or legal hold purposes. Archived seats are billed at 50% of the active per-seat rate across all subscription tiers. They do not count toward per-seat add-on charges (Live Email Security, SentrE, RiskE, ResidU).

Question 3

Can I change tiers mid-cycle?

Accepted Answer

Tier upgrades take effect immediately and are pro-rated for the remaining days in your billing period — the new tier's features unlock right away. Downgrades are processed by your VaultFuzion account manager and typically settle at the next billing cycle; MSPs cannot self-downgrade through the Partner Portal. Reach out to your account manager to discuss.

Question 4

What happens to my data if I cancel?

Accepted Answer

Upon cancellation, your data is available for export for 30 days. After that, it's securely deleted with SHA-256 destruction certificates issued as proof of deletion, in compliance with POPIA requirements.

Question 5

How do I get started?

Accepted Answer

Fill out the Get Started form on our website. Our team will contact you within 24 hours to set up your account, configure your M365 connector, and onboard your first tenants.

Question 6

What payment methods are accepted?

Accepted Answer

We process payments through Peach Payments, supporting credit/debit cards, EFT/bank transfer, and debit orders. South African customers are billed in ZAR with 15% VAT applied.

Question 7

How is storage calculated?

Accepted Answer

Storage includes all backup snapshots across Exchange, OneDrive, SharePoint, and Teams. Content-addressable deduplication is applied before calculating usage, which typically reduces actual storage by 40-60%. Overage is billed at R1/GB/month.

Question 8

Do add-ons get commitment discounts?

Accepted Answer

Base tier commitment discounts are 8% (1-year), 15% (3-year), and 20% (5-year). Standard add-ons (Live Email Security, Advanced Threat Detection, DMARC Monitoring, the AI Suite, etc.) are priced the same regardless of commitment period. VentraID Entra ID add-ons receive enhanced discounts: 15% (1-year), 25% (3-year), and 35% (5-year).

Question 9

What's the minimum for Enterprise?

Accepted Answer

Enterprise is custom-quoted in ZAR. There is a 1,500 billable seat minimum committed seat (MCS) floor. Pro-Heavy and Fortress carry a 350-seat MCS floor. Contact our sales team for an Enterprise quote tailored to your tenant footprint.

Question 10

Does VaultFuzion help us meet POPIA obligations?

Accepted Answer

Yes — the platform is engineered to support your POPIA programme. Per-tenant HKDF-derived encryption keys, configurable retention periods up to 7 years, automated disposition workflows, destruction certificates, and a tamper-evident SHA-256 audit chain are all included by default. POPIA compliance remains your responsibility as the responsible party; we provide the tooling and evidence trail to make that ongoing work auditable.

Question 11

Can I white-label the platform?

Accepted Answer

Yes, on the Enterprise tier and above. You can customise the Tenant Portal with your own logo, brand colours, and domain. Your clients will see your brand — not VaultFuzion.

Question 12

Which Microsoft 365 workloads does VaultFuzion back up?

Accepted Answer

Exchange Online (mail, calendar, contacts, tasks, notes), OneDrive for Business (files, version history, permissions), SharePoint Online (sites, lists, libraries, permissions), and Microsoft Teams (channel messages, files, meetings metadata). Public Folders are covered on Backup Pro and above. Power Apps and Power Automate flow definitions are protected through VentraID.

Question 13

What are VaultFuzion's RPO and RTO targets?

Accepted Answer

Recovery Point Objective (RPO) is up to 6 snapshots per day per workload — that is, a maximum data-loss window of approximately 4 hours. Recovery Time Objective (RTO) for item-level restore is typically under 5 minutes for a single mailbox item; full-mailbox restores complete within hours depending on size. RPO/RTO targets are defined contractually in your subscription agreement.

Question 14

How long are backups retained?

Accepted Answer

Retention defaults are 30 days (Starter), 90 days (Backup Pro), and 365 days (Pro-Heavy and Fortress). Enterprise customers can configure retention up to 7 years. Legal-hold-attached objects are retained indefinitely until the hold is released. Retention policies are POPIA-aligned and enforced by the engine, not by manual processes.

Question 15

Does VaultFuzion back up Microsoft Entra ID (Azure AD)?

Accepted Answer

Yes — through the dedicated VentraID add-on. VentraID Backup captures users, groups, conditional access policies, named locations, service principals, directory roles, devices, and authentication-method policies on a snapshot cadence. Higher VentraID tiers add drift detection, multi-framework compliance scoring, conditional-access What-If, and identity threat detection.

Question 16

Does VaultFuzion satisfy POPIA Section 19 (security safeguards)?

Accepted Answer

Section 19 of POPIA requires the responsible party to secure the integrity and confidentiality of personal information through appropriate, reasonable technical and organisational measures. VaultFuzion supports Section 19 compliance through per-tenant AES-256-GCM encryption, HKDF-derived keys, hash-chained audit trails, content-addressable storage, and restricted operator access through MSP isolation. Section 19 compliance remains your responsibility as responsible party — we provide the technical substrate.

Question 17

How does VaultFuzion support POPIA Section 22 (security compromise notification)?

Accepted Answer

Section 22 requires the responsible party to notify the Information Regulator and affected data subjects of a security compromise. VaultFuzion's tamper-evident audit chain provides forensic-grade evidence of what data was accessed, when, and by whom — the foundation for any Section 22 notification. We also surface incident timelines and integrity-verification reports through the Partner Portal so notifications can be drafted and substantiated rapidly.

Question 18

How does VaultFuzion handle POPIA Section 109 (data destruction)?

Accepted Answer

Section 109 governs personal-information destruction following the lawful retention period. VaultFuzion issues SHA-256 destruction certificates whenever data is purged, with the certificate hash chained into the audit trail. The certificate documents object identifiers, encryption-key destruction status, and the destruction timestamp — providing the responsible party with cryptographic proof of destruction for regulator submissions.

Question 19

Where is South African customer data stored?

Accepted Answer

South African customer data is stored in South African Microsoft Azure regions and Z1Storage facilities in Johannesburg by default. SA data residency is contractually committed in your subscription agreement. International customers may opt for alternate residency through their signed Master Services Agreement.

Question 20

Do I need to register an Information Officer for VaultFuzion?

Accepted Answer

You as the responsible party must register an Information Officer with the Information Regulator under POPIA — VaultFuzion does not register one on your behalf. Synchplus Consulting (Pty) Ltd has its own Information Officer registered for VaultFuzion-platform processing. Our Privacy Policy lists the Information Officer contact for VaultFuzion-internal data-subject requests.

Question 21

What is the POPIA compliance A-F grade?

Accepted Answer

The A-F compliance grade is VaultFuzion's internal scoring across 13 platform-level POPIA checks (Sections 19, 22, 109, retention, audit-chain integrity, encryption posture, etc.). It is operational scoring — not a regulatory verdict from the Information Regulator. The grade surfaces as a card on every tenant dashboard, with portfolio-distribution views for MSPs and platform-wide histograms for VaultFuzion staff.

Question 22

How does VaultFuzion compare to Veeam Backup for Microsoft 365?

Accepted Answer

Veeam is a strong on-premises-rooted backup product. VaultFuzion is a cloud-native MSP-first platform with per-tenant encryption keys, hash-chained tamper-evident audit, content-addressable deduplication, point-in-time restore across all four M365 workloads, and an integrated POPIA compliance engine. We also bundle identity protection (VentraID), DMARC (VaultDMARC), AI email security (SentrE), and eDiscovery in one subscription. Multi-tenant MSP isolation is native, not bolted on.

Question 23

How does VaultFuzion compare to AvePoint Cloud Backup?

Accepted Answer

AvePoint is a long-established player. VaultFuzion differentiates on evidence-grade audit (SHA-256 hash chain), per-tenant encryption keys (cross-tenant restore is structurally impossible), POPIA-aligned retention engine with destruction certificates, and bundled adjacent products (identity, DMARC, AI email security, eDiscovery). For South African MSPs, ZAR-native billing through PayI and SA data residency are differentiators AvePoint cannot match natively.

Question 24

How does VaultFuzion compare to Datto / Spanning?

Accepted Answer

Datto SaaS Protection (formerly Spanning) is mailbox-and-OneDrive-centric. VaultFuzion adds full SharePoint and Teams coverage, identity-plane protection through VentraID, AI email security (SentrE), and a POPIA-aligned compliance engine — which Datto does not bundle. Our pricing model bundles seat + tenant + compliance in clear tiers; Datto requires several adjacent products for equivalent coverage.

Question 25

How is data encrypted at rest?

Accepted Answer

Every tenant's backup data is encrypted with AES-256-GCM. Each tenant has its own data encryption key derived through HKDF from a platform master key — meaning a misrouted restore fails at the cryptographic layer, not at an application policy check. Master keys are stored in Azure Key Vault with purge protection. We never store raw card data — payment processing is delegated to Peach Payments.

Question 26

What is the hash-chained audit trail?

Accepted Answer

Every sensitive operation (backup, restore, retention apply, purge, legal hold change, key rotation) is recorded as an audit block. Each block includes the SHA-256 hash of the previous block, forming a tamper-evident chain. Modifying any historical block invalidates every subsequent hash — making tampering mathematically detectable and providing forensic-grade evidence for regulator submissions.

Question 27

How does MSP isolation work?

Accepted Answer

VaultFuzion enforces MSP isolation at three layers: (1) MSPOwnershipGuard blocks cross-MSP requests at the controller level; (2) Tier-1 services (Restore, Backup, Evidence, M365) re-validate tenant.mspId at the service level for defence-in-depth; (3) cross-MSP tenant lookups return HTTP 404 (not 403) to prevent existence disclosure. VaultFuzion staff retain access for support and operations under documented break-glass procedures.

Question 28

How long does onboarding take?

Accepted Answer

A standard MSP onboarding from contract signature to first protected tenant typically completes within 1-2 business days. Initial M365 OAuth consent, Partner Portal access provisioning, and first tenant configuration happen within hours. The first full backup snapshot duration depends on tenant size and Microsoft Graph throttling — typically 24-72 hours for a 100-seat tenant.

Question 29

What support is included?

Accepted Answer

Email support is included on every tier. Backup Pro and above receive priority support with 4-hour first-response targets during SA business hours. Pro-Heavy and Fortress include dedicated account management and AI security advisory. Enterprise customers receive 24/7 support with named technical contact. Support languages: English. Support escalation procedures are documented in your subscription agreement.

Question 30

Can I migrate from another backup provider?

Accepted Answer

Yes — VaultFuzion includes a 7-step migration wizard for incumbent backup providers (AvePoint, Veeam Backup for M365, Datto, Spanning, Acronis Cyber Protect, Keepit). The wizard exports historical data, validates integrity, and re-ingests into VaultFuzion with continuity of retention dates. Migration timing is driven by historical-data volume; typical 100-seat migrations complete in 1-2 weeks.

Frequently Asked QuestionsFrequently Asked Questions