Retention & Archiving Overview
Archiving and retention are one continuous flow, not two separate features. Archiving decides when an item moves into your tenant's protected vault. Once it is there, the vault's own storage-provider lock decides how long it stays protected.
One flow, two questions
On a schedule you configure (daily by default, or weekly on a chosen day), BYOVault checks every backed-up item still sitting in primary storage against its real, source-side last-modified date — not the date BYOVault happened to back it up.
Each workload (SharePoint, OneDrive, Exchange, file servers) has its own configurable threshold, so an item whose source content has gone untouched longer than its workload’s threshold becomes eligible to move.
Archiving is the mechanism that answers when. It copies a qualifying item’s bytes into a genuinely separate storage account or container — the vault — verifies the copy landed correctly, and only then removes the original from primary storage.
Retention is the mechanism that answers how long. Once an item is in the vault, it is locked using your cloud provider’s own real immutability mechanism:
- AWS — S3 Object Lock in Compliance mode.
- Azure — a locked, container-level time-based immutability policy.
The cloud provider itself refuses to delete or modify the item — including BYOVault or a compromised administrator account — until the retention period elapses.
An item still sitting in primary storage is never locked; it becomes protected only once archiving has moved it into the vault.
Provider-enforced, not application-enforced
The lock is enforced at the storage-provider level, never as a database flag or an application-side check.
Once your tenant’s vault is locked, the lock cannot be turned off — this is irreversible by design, the same way AWS Compliance mode and Azure’s locked policies are engineered to be irreversible.
See Planning Your Retention Period before provisioning a tenant’s vault.
What is in this section
- How the Vault Is Provisioned — creating and locking a tenant’s retention vault.
- Retention Policy — the provider-enforced lock itself, and what it guarantees.
- Extending a Retention Period — how lengthening the period differs between Azure and AWS.
- Archiving — the scheduled sweep that moves items into the vault.
- Item Lifecycle & Tier States — every state a backed-up item moves through, end to end.
- Vault Integrity Checks — how BYOVault verifies its own retention guarantee.
- Preserve (Legal Hold) — the operator override that keeps an item out of the archiving sweep, so it is never vaulted or locked.