Skip to main content

Cloud storage

Updated

Backups tracks storage configuration and utilization for each organization. This includes quota settings, how much storage is in use, and whether storage is classified as cloud or on-premises. Vendor credentials — the API keys used to connect to each backup vendor — are stored separately in Azure Key Vault.

The storage page reflects what Backups knows about your backup storage footprint. For the workloads Backups captures itself (endpoint files and folders, and SaaS), the backup data is written into the platform's own object storage. For a connected third-party vendor, the data stays in that vendor's storage environment.

Where Backups Are Stored

Where a backup lives depends on which path captured it. The platform's own captures (endpoint files and folders, Microsoft 365 and Google Workspace) are written into the platform's own object storage. When you connect a third-party vendor (Veeam, Datto, Acronis, Cove, Backup Exec, or another), that vendor's data is retained in its own cloud or your on-premises storage as configured in the vendor, and Backups reads job metadata (status, size, timestamps) from the vendor API. ⚠️ The third-party vendor path is built but not yet collecting — no tenant has a vendor configured and end-to-end collection is unproven.

Storage Configuration in Backups

Each organization has a storage record in Backups that tracks:

  • Name — a label for the storage entry
  • Type — cloud or onprem
  • Tier — storage classification (maps to your retention tiers)
  • Retention — the retention window associated with this storage
  • Quota — the total storage capacity allocated (in bytes)
  • Used — current usage
  • Total — total bytes across all jobs

Viewing Storage Utilization

  1. Go to Storage.
  2. The page shows current utilization against quota for your organization.
  3. If utilization looks incorrect, click Recalculate to refresh the numbers from the latest vendor sync data.
  4. Update the Quota value if your actual allocated capacity has changed.

Updating Storage Settings

  1. Go to Storage.
  2. Click Edit (or use the PATCH action on the storage record).
  3. Adjust the quota, tier, or retention values as needed.
  4. Save. Changes take effect immediately for reporting and SLA calculations.

Vendor Credential Storage

Vendor API credentials are not stored in the Backups database. When you create a vendor connection:

  1. The credentials you enter are saved to Azure Key Vault.
  2. The vendor record in Backups stores only a reference name that points to the Key Vault secret.
  3. When the sync worker needs to authenticate with the vendor, it resolves the reference from Key Vault at runtime.

This means that rotating a vendor credential requires updating the secret in Azure Key Vault and then confirming it on the vendor record in Backups.

Encryption

Backup policies in Backups include an Encryption Required flag. For a third-party vendor, that flag signals the vendor's own software to encrypt the job on its side, and the vendor enforces it at the point of storage; Backups only tracks whether the requirement is set on the policy.

For the workloads Backups captures itself, encryption is applied by the platform, not the vendor. Endpoint and SaaS data is encrypted client-side with AES-256-GCM under a per-organization key (the org key is itself stored wrapped by a server master key), and the storage provider only ever sees ciphertext.

FAQ

Where is the actual backup data? It depends on the path that captured it. The platform's own captures (endpoint files and folders, and SaaS) are written into the platform's own object storage, encrypted client-side. For a connected third-party vendor, the data is in that vendor's storage — their cloud platform or your on-premises target as configured in the vendor software — and Backups reads metadata only.

How do I change the storage quota shown in Backups? Go to Storage and update the Quota field. This is a tracking value; it does not resize your actual storage allocation with the vendor.

Can I see per-client storage breakdown? Per-client storage context is available through the client management view and the coverage reports. The storage page reflects org-level totals. For per-client breakdowns, see Client Management and Reports.

Related