One sealed vault. Every way back.
Kapsul8 is one evidence-grade engine for Microsoft 365: an agentless Microsoft Graph connection, nothing to install. Everything is deduplicated, sealed with per-tenant keys, and recorded on a hash-chained audit trail.
Exchange · OneDrive · SharePoint · Teams, agentless Graph delta sync
Deduplicate → encrypt (per-tenant AES-256) → hash-chain every operation
SA storage or BYOS · retention 30d–7y · destruction-certified
Every backup walks the same four steps.
Graph delta sync on the cloud side; VSS-consistent file and image snapshots on the machine side. Only changes move.
Content-addressable storage: identical data across users and machines is stored exactly once.
AES-256 with a separate key per tenant, at rest in South Africa by default, or in your own S3 bucket with BYOS.
Every backup, restore, and retention action lands on a SHA-256 hash chain; disposal ends with a destruction certificate.
The cloud intake, agentless and delta-first.
Four workloads captured from one engine. Restore granularity differs by surface, and the matrix below says where each one stops. Cursor persistence means the sync survives Graph API throttling and outages without starting over.
Immutable storage by default. Managed backups are written to independent, write-once storage under S3 Object Lock in compliance mode — a copy outside your Microsoft tenant that stolen admin credentials can’t reach, and that stays locked until the retention period you set expires.
Full mailboxes with delta sync, after the first full backup, only changes move.
A single mail item or the whole mailbox, to any retained point in time. Restored in place, it adds back what is missing and leaves what is still there untouched.
Per-user drives, personal and shared, kept according to your retention policy.
Granular file restore to any retained backup point in time. Restored in place, a file that changed since the backup is kept and the backed-up version lands beside it, unless you choose to replace or skip it; Microsoft does not support an app-only replace of a file protected with a sensitivity label, so Replace cannot overwrite those.
Site collections including documents, lists, permissions, and metadata.
Selective restore of individual documents, handled like OneDrive files; a list restores as a set that skips the items still there.
Channel messages, files and tabs — standard, private and shared channels included. 1:1, group and meeting chats are captured in the backup; they are not yet browsable or exportable in the portals.
Channel files restore like any SharePoint file when the team’s site is backed up; top-level channel messages restore with their original author and time, without their replies, reactions, inline images or attachments. Missing messages come back in a new restored channel in the same team, never into the live one, and messages still in the channel are left as they are; private and shared channels are not restored, and the reason is given. 1:1, group and meeting chats are not restored into Teams. Executed by an MSP administrator, from the last backup of the day you choose.
Priced per seat. The rate falls as you grow.
M365 Backup runs from R29.99 a seat at 1–9 seats down to R11.99 from 1,000, with a further 10/18/25% off on one, three and five-year terms. One console, one invoice.
Frequently asked questions.
See it running against your own tenant.
Tell us about your MSP and we will reply within one business day. Tenant and partner-portal configuration typically follows within one to two business days.