Glossary
Short, exact definitions for the terms used throughout this documentation and inside BYOVault's own dashboard, matched to the product and UI vocabulary you'll actually see, not looser industry synonyms.
| Term | Definition |
|---|---|
| Delta link (delta sync) | The incremental-change token Microsoft Graph’s delta query returns for a drive, site, or mailbox. BYOVault stores it per resource and passes it back on the next scheduled run instead of requesting a full listing every time; Graph then returns only items that were added, changed, or deleted since the token was issued. The first run for a resource has no stored token and performs a full scan, which also produces the first delta link to store. See Incremental Backup & Change Detection. |
| File Key | A random 256-bit AES key generated fresh for a single file, used only under customer-managed keys (BYOK). It is never derived from BYOVault’s shared master key and is never reused across files. The File Key encrypts that one file’s content, is held in memory only for the duration of the upload or restore operation, and is wiped immediately afterward. See Customer-Managed Keys (BYOK). |
| Preserve | An operator-only override that exempts a specific file, folder, or drive/mailbox from the vault-move sweep indefinitely, typically applied in response to a legal hold or a client request made outside the normal retention window. A preserved item is never picked up by the move into the vault while preserved. It can be lifted (released) later, which makes the item eligible for the vault move again on the next sweep. See Preserve (Legal Hold). |
| Storage destination | The storage account currently connected for a tenant. Saving a tenant’s storage configuration — whether you are connecting an account for the first time, replacing it, or re-entering the same details — makes the next backup run treat the destination as new and re-upload every item, rather than assuming files are already present there. |
| Item status | The current position of one backed-up item in its retention lifecycle, shown in BYOVault’s dashboard. An item moves through three states:
|
| Vault | A storage account separate from the tenant’s primary backup storage, used exclusively to hold items once they have passed into retention. A vault is locked using the storage provider’s own immutability mechanism — Azure’s container-level immutability policy or AWS S3 Object Lock in Compliance mode — so that once an item is locked, it cannot be deleted or overwritten by anyone, including BYOVault, until its retention period expires. A tenant has exactly one active vault at a time; a prior vault that has already been superseded keeps independently enforcing its own lock. See How the Vault Is Provisioned and Retention Policy. |
| Workload | One of the four data sources BYOVault backs up: SharePoint, OneDrive, and Exchange (all reached through Microsoft Graph), and File Servers (reached through an on-prem agent, not Graph). Delta sync applies only to the three Graph-based workloads; File Servers uses a different change-detection mechanism since there is no Graph delta query for a local file share. See Workloads Overview. |
| Wrapped key | A File Key after it has been encrypted (“wrapped”) under the tenant’s own customer-managed key in their own AWS KMS or Azure Key Vault. Wrapping happens exactly once per file, immediately after that file’s content has been encrypted with the File Key; only the wrapped key is retained afterward, never the unencrypted File Key. Unwrapping it again — a call back to the tenant’s own KMS — is required before that file can be decrypted at restore time. |