Archiving

Archiving moves aged, backed-up items out of Hot storage and into your tenant's protected retention vault — a genuinely separate storage account, not just a cheaper price tag on the same file.

What moves, and when

On a schedule you choose — daily or weekly, at whatever time is off-hours for the client — archiving checks every Hot-tier item against how long it has been since the file’s real source last-modified date, not the date BYOVault backed it up. Items whose source content hasn’t changed in longer than your configured window are eligible to move.

Archiving decides when; the vault's lock decides how long
Archiving and Retention now use the same real-world clock — the file’s actual last-modified date at its source, so a genuinely old, untouched file qualifies quickly even if BYOVault only started backing it up recently. Archiving’s job is deciding when a file is old enough to move into the vault; once it’s there, the vault’s own provider-enforced lock decides how long it stays protected. These are no longer two independent clocks — they work together as one continuous flow.

A real move, not a relabel

When a file qualifies, its bytes are copied into the tenant’s separate vault storage account, the copy is verified to have landed correctly, and only then is the original removed from primary storage. This is a genuine, physical relocation — not merely a storage-class change on the same object in the same account. Real isolation matters here: if a client’s everyday primary storage account is ever compromised, files already moved into the vault are unaffected, because they are no longer even in that account.

The vault’s own storage class is set automatically and never surfaced as a separate setting — there is nothing to configure here beyond how long a file waits before moving.

Supported storage backends

  • Azure Blob Storage — the vault is a container with a locked time-based immutability policy.
  • AWS S3 — the vault is a bucket with Object Lock enabled in Compliance mode.
Google Cloud Storage
Archiving and the retention vault are not available for tenants using Google Cloud Storage as their backup destination — it cannot be enabled for a GCS-backed tenant today.

Instantly readable, always

Neither the vault’s storage class nor Azure/AWS’s immutability features ever use a slow-to-retrieve archive tier (Azure Archive tier or AWS Glacier) — both would require a multi-hour rehydration before a file becomes readable again, which would silently break self-service restore’s instant-read guarantee. Restoring a file that has already moved into the vault works exactly the same as restoring one still in Hot storage.

Why it matters for retention

A file only ever becomes genuinely, provider-locked once archiving has moved it into the vault — a file still sitting in Hot storage is never locked. See Retention Policy for exactly what happens once a file arrives there, and how long it stays protected.

PreviousRetention PolicyNextPreserve (Legal Hold)