// recovery_layer
Backups ransomware cannot reach.
Immutable, isolated backup and recovery for SaaS tenants, on-premise estates and everything hybrid in between — deployed, monitored and restored by the same engineers who tune your monitoring platform[cite: 2].
- SOC_COVERAGE
- 24 / 7
- STORAGE_MODE
- IMMUTABLE
- ISOLATION
- OFF-PRODUCTION
- SAAS_BACKUPS
- UP TO 4× / DAY
- MGMT_MODEL
- FULLY MANAGED / SELF-RUN
Threat model
Encryption, deletion, tenant takeover
Restore scope
Item-level to bare metal
Data efficiency
Deduplication + compression
Essentials residency
Two data centres, Sweden
// service_modules
Three deployments of one principle
Every module writes an immutable copy of your data outside the blast radius of the system that produced it[cite: 2]. Pick by where the workload lives and how much of the operation you want to keep[cite: 2].
MODULE_01
Vault Cloud
Managed backup for SaaS and cloud identity — the tenants you depend on but do not host[cite: 2].
- Up to four automated backups per day[cite: 2]
- Immutable, encrypted storage outside the production tenant[cite: 2]
- End-to-end encryption, GDPR-aligned design[cite: 2]
- Granular restore of items, sites and configuration[cite: 2]
- Continuous monitoring, minimal manual handling[cite: 2]
MODULE_02
Vault On-Prem
An isolated recovery environment for the estate in your own racks — kept restore-ready, not just backed up[cite: 2].
- Always-on recovery readiness[cite: 2]
- Isolated, secure recovery environment[cite: 2]
- Immutable storage with ransomware protection[cite: 2]
- Full-system recovery into a clean environment[cite: 2]
- Managed onboarding and offboarding[cite: 2]
MODULE_03
Vault Essentials
The same recovery platform, deployed by you, billed on consumption[cite: 2]. Built for lean teams with mixed estates[cite: 2].
- Deploys from a single configuration file[cite: 2]
- Secure one-way communication to the backup target[cite: 2]
- Deduplication and compression on ingest[cite: 2]
- Bare-metal recovery, physical and virtual[cite: 2]
- Backup copies held in two Swedish data centres[cite: 2]
// platform_coverage
What we can protect today
If it is on this list, onboarding is configuration rather than a project[cite: 2]. If it is not, tell us what it runs on — most gaps close with an agent or an API connector[cite: 2].
SAAS & CLOUD
Vault Cloud targets
Identity is included deliberately: an Entra ID or Okta rollback is often the first step in recovering from a tenant takeover[cite: 2].
SERVERS & VIRTUAL
Vault On-Prem targets
Legacy Unix estates are included on purpose — they are usually the systems with the least tested recovery path[cite: 2].
// deployment_protocol
How an engagement runs
01
Estate scan
Workloads, dependencies and current backup state, mapped against what the business actually needs back first[cite: 2].
02
Design
Module selection, schedules, retention, residency and isolation boundaries — written down before anything is installed[cite: 2].
03
Deploy
Onboarding and first full backup[cite: 2]. Essentials bootstraps from one configuration file, which keeps manual error out of it[cite: 2].
04
Run & restore-test
24/7 SOC monitoring, scheduled restore tests, and a documented result each time — so the first real restore is not the first restore[cite: 2].
// operating_model
Hand it over, or keep the console
Two ways to run this, and the difference is deliberate[cite: 2]. Both sit on the same platform with the same 24/7 monitoring underneath[cite: 2].
OPTION_A
Fully managed — Vault Cloud & Vault On-Prem
- We own onboarding, configuration and offboarding[cite: 2]
- We watch the jobs and chase the failures[cite: 2]
- We drive the restore during an incident[cite: 2]
- You get reporting and tested recovery evidence[cite: 2]
Best when the team is stretched, or when recovery has to hold up under audit[cite: 2].
OPTION_B
Self-run — Vault Essentials
- You deploy from the supplied configuration file[cite: 2]
- You keep full operational control of schedules and restores[cite: 2]
- Consumption-based cost, scaling with what you protect[cite: 2]
- 24/7 SOC support stays underneath you[cite: 2]
Best when you have capable hands in-house and want the platform, not the service wrapper[cite: 2].
// engineering_faq
The questions engineers actually ask
What stops an attacker with domain admin from deleting the backups?
Immutability plus isolation[cite: 2]. Copies are written to storage that will not accept a modification or deletion request for the retention period, and that storage does not sit inside the production trust boundary[cite: 2]. Credentials taken from the estate do not carry authority over the recovery environment[cite: 2].
How does traffic reach the backup environment?
Vault Essentials uses secure one-way communication towards the backup target, so there is no inbound path from the backup environment into your network[cite: 2]. That direction matters: it removes the backup service as a lateral-movement route[cite: 2].
What does recovery look like for a full server loss?
Bare-metal recovery for physical and virtual workloads, or full-system recovery into an isolated clean environment when production cannot be trusted yet[cite: 2]. The second path is what you want during an active ransomware incident — rebuilding into a compromised network simply reinfects[cite: 2].
Will this blow up our storage volumes?
Deduplication and compression run on ingest, so repeated blocks across systems and daily cycles are stored once[cite: 2]. Actual ratios depend on your data profile; we size it during the design step rather than quoting a number here[cite: 2].
Where does this sit next to our monitoring platform?
Alongside it, run by the same team[cite: 2]. We already build and maintain SCOM, Azure Monitor and hybrid observability estates — so backup job health, agent state and restore-test results land in the monitoring you already look at, instead of a separate console nobody opens[cite: 2].
Can you take over a backup platform we already have?
Usually, yes — we start with an assessment of what is configured, what is actually completing, and what has never been restore-tested[cite: 2]. Migration path and any parallel-run period come out of that[cite: 2].
// next_step
Send us the estate, get a recovery plan back
A short technical session: what you run, what is protected, what has never been tested[cite: 2]. You leave with a module recommendation and a sizing range — no commitment attached[cite: 2].