A backup that ran is not a backup that restores.

Backups fail quietly. You find out on the worst possible day.

Every one of these looks like a green checkmark in a dashboard:

• The cron job ran, but the source directory was remounted empty three weeks ago.
• The dump succeeded, but a flag was dropped in a config edit and the dump is inconsistent.
• Encryption worked. The passphrase was rotated. Nobody wrote it down.
• The object was uploaded, then a lifecycle rule moved it to a storage class you cannot read back inside an outage window.
• The archive is fine. The restore path has never been executed by anyone at your company.

Automated restore verification is not a new idea. Veeam, Datto and NAKIVO have shipped it for years — priced per socket, sold through resellers, built around booting VMs. Nobody brought it down to the person running three VPSes. That is the part we built.

Where this fits in 3-2-1

Vaulta does not replace the 3-2-1 rule. It is the “1” — the offsite copy — and it covers the “0” in 3-2-1-1-0: zero errors, meaning a restore that has actually been tested rather than assumed.

Keep your local copy on whatever you already use — ZFS snapshots, a NAS, your hypervisor. Those are good at being fast and local. They are not good at surviving the room they live in, and nobody verifies them either.

The industry spent twenty years arguing about how many copies to keep and almost none on whether any of them come back. The “1” is well served by a dozen products. The “0” is served by almost nothing under enterprise pricing.

What Vaulta backs up today

We list what is shipping and what is not. Nothing below is aspirational.

Storage backends

Your backup data goes straight into object storage you own and pay for directly. Three backends are certified, and we list exactly what works on each — “S3-compatible” means different things at different vendors, and we tested rather than assumed.

About those two cost rows. They are what the storage vendor charges you, billed by them to your own account. They are not part of a Vaulta subscription and we receive none of it. The figures are published list prices at the time of writing, rounded and shown only so the three are comparable — regions, minimum retention periods, request charges, storage classes and free tiers all vary and all change. Price your own case against each vendor’s own pricing page, not against this table.

About space reclamation on B2

When a retention policy expires a snapshot, Vaulta runs a garbage collection pass to actually free the space. That pass takes an exclusive maintenance lock, and the lock relies on an atomic conditional write that Backblaze B2’s S3-compatible API does not implement. Rather than fall back to a non-atomic lock — two concurrent passes would risk corrupting a repository — we refuse to run it on B2.

In practice: on B2, expired snapshots are marked but their storage is not released, so your B2 bill grows monotonically. B2’s headline price is the lowest of the three, but that advantage only holds while the total stays small — and for a backup target the total does not stay small, because backups are by definition something you keep adding to. If you want a cheap target where the bill actually goes down when retention expires, use Cloudflare R2, which implements the conditional write and reclaims space normally. Read the R2 caveat below first: it buys that on the one hand and gives up versioning and immutability on the other.

We would rather tell you this now than have you find it on month three of a bill that never goes down.

Vaulta speaks plain S3, so other providers may work — but we have not certified them, and this page only lists what we tested end to end. Local disks and NAS targets are not supported.

How the immutability claim was tested — and where it stops

We armed an object in a live AWS S3 bucket under COMPLIANCE-mode Object Lock with a 90-day retention, and verified across the full 90 days that version-targeted deletes were refused, the retention period could not be shortened, and the object’s SHA-256 never changed. It became deletable exactly at the retain-until timestamp — not a moment before.

That result covers Amazon S3 only. Backblaze B2 documents Object Lock support, and most of our B2 test scenarios pass — but one deletion test returns an access-denied error we have not yet traced to a definite cause. It may be Object Lock doing its job; it may be a permissions gap. Until we can tell those two apart, we will not claim immutable retention on B2. If ransomware protection is why you are here, use Amazon S3 today.

Cloudflare R2 is a different and clearer case: it does not offer object-level retention at all. The S3 call that arms immutability (PutObjectRetention) returns 501 Not Implemented. We checked that this was a missing feature and not a permissions problem: the same token, on the same bucket, uploads and deletes successfully, and asking for the bucket’s lock configuration returns a permission error rather than 501 — Cloudflare answers “not allowed” and “not implemented” differently. R2 does have a bucket-level lock, which is not the same control and is not what Vaulta’s retention uses.

There is a second consequence worth stating plainly, because it is the more serious of the two: R2 does not keep object versions at all — ListObjectVersions also returns 501. On Amazon S3 and on Backblaze B2, deleting an object leaves a previous version behind, so an accidental or malicious delete can be undone. On R2 there is nothing to undo: the object is gone. Your agent holds storage credentials on the machine it backs up, so if that machine is compromised — the exact scenario immutability exists to survive — backups on R2 can be erased permanently. Everything else on R2 works, including space reclamation. It is a good cheap target for data you could tolerate losing to a determined attacker, and the wrong target for data you could not.

Agents authenticate to the control plane over HTTPS with a bearer token. Backup contents are encrypted client-side with AES-256-GCM before upload; the control plane stores scheduling metadata only, never file contents and never your encryption key.

Pricing

One Asset = one machine running one agent. Everything you back up on that machine — files, databases, Docker, whole-machine images — is included. No double-counting. Storage is billed by your own cloud provider, not by us.

Annual plans are billed as ten months. Subscriptions can be cancelled at any time and are covered by our 14-day, no-questions-asked refund policy.