Immutable*
Check whether a storage lock permits an administrator bypass.
EnterProtect's locks use compliance mode, which has no bypass, so nobody can shorten one, including us.
Backup EvidenceYour Client'sAuditor Can Check
When a client asks who can delete their backups, show them the lock. When an auditor asks what restored, hand over the report. Keep cloud copies in the region you choose, with support access that needs your approval.
- Locks that renew daily and that nobody can shorten, including us
- Support access requires approval and expires automatically
- A signed certificate for every destruction
Review the Controls Behind the Backup
Client questionnaires often ask where data is stored, who can access it and whether backups can be deleted. These controls leave records you can use to answer those questions.
Deleted*
Check what record is issued when a client's data is destroyed.
EnterProtect ends every destruction with a signed certificate that outlives the data it describes.
Support Access*
Check who approves support access, what it covers and when it expires.
Your MSP Owner must approve support access to a named resource for a limited period.
Non-payment*
Check what happens to existing backups if payment fails.
A missed payment stops new captures after the grace period. Accepted backups remain locked and recoverable for their retention term.
Locks That Renew Daily and Only Ever Extend
Every cloud recovery point sits under a 30-day compliance-mode object lock that renews daily for as long as it's retained. Retention can be extended, never shortened, by anyone, including EnterProtect. A missed renewal is an incident.
How Accepted Cloud Backups Are Isolated
The following controls isolate accepted cloud recovery points from compromised accounts and systems. They protect existing copies; a compromise can still interrupt future backups.
The Protected Machine, Its Domain or Its Agent
The agent can open a session and upload. It can't list, read, delete, shorten or decrypt anything. Ransomware running as SYSTEM can stop future backups, which raises an alert, and can't reach back into history.
The Appliance, Root Included
The appliance is a cache for speed, and root can destroy that cache. Its cloud credential can only add data, for one client, and is revoked from the console without the appliance's help. The cost is recovery time, not data.
The Client's Microsoft 365 Tenant
Retention policies, holds and the recycle bin all live inside the tenant. The backup lives outside it, where a compromised Global Administrator can't reach.
The EnterProtect Console, Its Database or an Administrator
Retention, encryption keys and the audit record run as separate services, with separate credentials and separate administration. The console cannot override those services' retention or access controls.
Your MSP Owner Account
It can't shorten retention already committed to a recovery point, delete one, destroy a key or rewrite the audit trail. A shorter retention setting applies only to recovery points created after it.
The Ingest, Replication or Storage Credential
The ingest credential can only add data. None of them can delete an accepted object, shorten its lock or administer the storage account.
Support Access Requires Your Approval
Support has no access to client data by default. Your MSP Owner approves a time-limited grant for one resource.
- 01
Access Is Tied to a Support Case
An engineer requests access tied to a support case, naming one resource and what they need to do. A request nobody has approved reaches nothing at all.
- 02
A Second EnterProtect Approver, for Content
Reading backup content needs a second EnterProtect approver who is never the requester. Operational metadata needs your approval only.
- 03
Your Owner Approves the Resource and the Window
Nobody at EnterProtect can approve their own access. The lease reaches the one resource it names and nothing beside it.
- 04
Access Expires Automatically
Your console shows the lease counting down. Access expires automatically at the approved time, and you can revoke it sooner.
- 05
Recorded Where Your Client Can See It
Every grant and every use lands in your client's own access record, with its case, scope and expiry. You're notified when a grant is approved and again when it ends.
How the Evidence Works
Review the controls for capture, storage, encryption, audit records and deletion.
Capture That Can't Write
Microsoft 365 is captured by a read-only identity that writes nothing, and write access exists only for one restore, scoped to it, and expires by itself. A protected machine's agent can upload and nothing else, and can never decrypt what it sent.
Stored in the Region You Choose
You choose each client's storage location from the set you allow, and the region is confirmed before the first capture. Backups are stored there, and moving storage is an explicit, audited migration.
Encrypted Before It Lands
Content is encrypted before or at ingest in its region and never lands in storage as plaintext. Keys sit with a key authority outside the console, and no console, storage or MSP administrator can destroy one to delete data early.
A Record Nobody Can Edit
Audit rows are insert-only for everyone, your Owner and EnterProtect included. Browsing a recovery point is recorded as content access, and people are deactivated rather than deleted, so the record outlives their access.
Deletion You Can Prove
When a client's service ends, eligible data is destroyed within 31 days unless a hold keeps it, and a signed certificate records what was destroyed, where and when. An incomplete purge gets no certificate.
An Insurer Asks for Evidence. Have It Ready.
Pull verification results, restore tests and retention records into one dated bundle. Give the client something to forward, without rebuilding the same evidence from scratch.
Coverage and Missing Evidence
One dated document per client, covering every product they use: validation results, restore-test outcomes, immutability receipts and destruction certificates, each traceable to the record it came from. Anything it can't show is named, and no section can be left out, so a missing section never hides a gap.
The Open-Source Engine, Kept Recoverable
File Backup runs on an open-source file engine, embedded behind EnterProtect's own adapter. The engine handles the file mechanics. Everything that's a promise stays EnterProtect's: what counts as a recovery point, who may delete one, the keys, retention and audit. For every version we ship, we keep the exact source, build toolchain, dependencies, patches, licences and SBOM. The repository format is documented as a specification, the engine version is recorded on every recovery point, and a clean-room recovery with no console, no database, no network and no upstream project is exercised on a schedule. Open source never means security is outsourced: when upstream is slow on a CVE, we patch it ourselves.
Questions Auditors Ask
Have a question about your setup? Contact our team.
Can an attacker with admin access delete my clients' backups?
Not an accepted cloud copy. Locks are in compliance mode, which has no bypass, and retention, keys and audit run outside the console's reach. An attacker who fully compromises the console, or your Owner account, can't shorten retention or delete a recovery point.
Can EnterProtect delete or shorten a backup?
No. A compliance-mode lock can be extended and never shortened, by anyone, including EnterProtect. EnterProtect's own staff tools can request, schedule and record, and they never destroy.
Can EnterProtect support see my clients' data?
Not unless your MSP Owner approves it. Support holds nothing by default. A grant names one resource and a window, backup content also needs a second EnterProtect approver who is never the requester, and every grant and every use lands in the client's own access record. If that record shows no lease, EnterProtect can't see in.
Where is my clients' data stored?
In the storage location you choose for each client, from the set you allow. The region is confirmed before the first capture, and moving storage is an explicit, audited migration.
Is the BCDR appliance immutable?
No, and the product says so. The appliance is a local cache for speed, encrypted and integrity-checked, and its root account can destroy it. The immutable copy is in EnterProtect's cloud, on by default, and turning it off needs a recorded acknowledgement that nothing is then immutable.
What happens to backups if we stop paying?
New captures stop after a short grace period, and you're told out of band. Everything already accepted stays immutable and recoverable for its full term, and a suspended MSP can still get a recovery through support. Non-payment can never authorise early deletion.
How do you prove a client's data was destroyed?
With a signed destruction certificate. When service ends, a 30-day cooling-off runs alongside the last lock, and eligible data is destroyed within 31 days unless a hold keeps it. The certificate names the client, products, storage locations, timeline, authorisation and completion time, and it's issued only once the inventory reconciles.
Is my clients' data encrypted?
Yes, under per-client keys or finer, before or at ingest in its region, so nothing lands in storage as plaintext. The identity that sends a backup can never decrypt it. Decryption for a restore activates just in time and expires with that restore.
Can we recover if EnterProtect itself is down?
For BCDR, yes. An appliance keeps backing up, validating and serving restores from its last signed configuration while EnterProtect is unreachable. With the offline recovery key your Owner generates and keeps, an exact recovery point on an appliance or a portable bundle restores read-only with no EnterProtect service running. EnterProtect stores only the public half of that key.
Does EnterProtect ever ask for a Global Administrator password?
No, never, for any reason, including during setup. Microsoft 365 connects through Microsoft's admin consent flow, and the client's administrator sees the exact list of permissions requested before consenting.
Give Clients Evidence They Can Check
You shouldn't have to ask a client to take your word for it. Show them the storage, access and recovery records behind these commitments.
Commitments in Writing
- A lock can be extended. It can never be shortened, by you or by us.
- Backups stay in the region you chose. Recovering outside it takes consent given at purchase.
- Support reaches nothing until your Owner approves it.
- Every destruction ends in a signed certificate.
- A missed payment pauses service. It never shortens an immutable copy.