GDPR-compliant Microsoft 365 backup, hosted in Germany
Your backups stay in the EU, with primary storage in Germany and a German company under German and EU jurisdiction behind them. Every object is encrypted before it is stored, and the contracts are published for you to review.
Where your backup lives is your responsibility
Under the GDPR you remain responsible for the personal data in your emails and files — including every copy a backup provider keeps. The location of the data, who can access it and which law applies are therefore part of choosing a provider.
A backup service needs a data processing agreement under Art. 28 GDPR, documented technical and organisational measures under Art. 32, and storage that does not quietly move data to third countries.
Data protection built in, not bolted on
From the storage location to the keys — everything you need to document a compliant backup.
EU-only storage
All data is stored and processed exclusively in EU data centers, with primary storage in Germany and secondary storage in Finland. No US-based sub-processors are used for storing or processing customer data.
Encrypted before storage
Every object is encrypted with AES-256-GCM inside the platform before it reaches storage, with a separate key per tenant. Bring your own key if you want full control.
Published DPA and TOM
Our data processing agreement under Art. 28 GDPR and our technical and organisational measures under Art. 32 GDPR are public — review them before you sign up.
Access control and audit trail
Four roles with more than 20 permissions enforce least-privilege access, and every administrative action and data access is logged for your records.
How it works
- 01
Review the documents
Read the DPA, the TOM and the list of sub-processors — all available on our website.
- 02
Start the backup
Connect Microsoft 365 and choose what to protect; the data goes straight to EU storage, encrypted.
- 03
Document and control
Use roles, audit logs and retention policies to show who can access what and how long data is kept.
Frequently asked questions
- Where exactly is my data stored?
- In EU data centers: primary storage in Germany, secondary storage in Finland. The data does not leave the European Union.
- Do you offer a data processing agreement (DPA)?
- Yes. Our DPA under Art. 28 GDPR is published on our website and covers sub-processors, data subject rights, technical measures, breach notification and audit rights.
- Who can see my data in the backup?
- Only the users you give access through roles — and every access is logged. Data is encrypted inside the platform before it reaches storage, so the storage provider only ever sees ciphertext. With your own key you can additionally make all archived data permanently inaccessible by revoking it.
- Does GraphCapsule help with NIS2?
- GraphCapsule's EU-hosted infrastructure, audit logging, incident response procedures and encryption standards are aligned with NIS2 requirements. Whether and how NIS2 applies to you depends on your organisation.
- What happens to my data if I cancel?
- Your data remains available until the end of your billing period, and you can export it. After that, it is securely deleted.
Related topics
Security
How GraphCapsule protects Microsoft 365 backups: AES-256-GCM encryption before storage, keys in HashiCorp Vault, optional customer keys, EU-only storage.
Email archiving
Tamper-proof email archiving for Microsoft 365: WORM storage with SHA-256 hash chains, retention from 1 to 10 years, legal hold and eDiscovery export.
Exchange Online backup
Exchange Online backup for mailboxes, shared mailboxes, calendars and contacts. Restore single emails or whole mailboxes in minutes, hosted in the EU.
OneDrive & SharePoint backup
OneDrive and SharePoint backup with full version history. Restore single files, folders or whole sites in minutes — encrypted and hosted in the EU.
Protect your Microsoft 365 data today
30 days free with up to 5 mailboxes, no credit card required. Set up in minutes.