Microsoft 365 for Education — Backup & Audit, Free to Start

Zero-knowledge Microsoft 365 backup and audit for schools and universities — pupil data the vendor cannot read, free for one administrator, one-time migration pricing.

Frequently asked questions

Pupils are often minors, whose data warrants heightened protection. GTools.pro keeps that data inside the school’s control: it is zero-knowledge (the vendor only ever holds ciphertext), and the Desktop edition keeps all backup and audit data on the institution’s own machine, so no readable copy of pupil data reaches a third-party cloud. This is general information, not legal advice — check with your data-protection officer.

Is there a free Microsoft 365 backup option for a school administrator?

Yes. The Solo SKU is permanently free for a single Microsoft 365 administrator. Paid editions add tenant-wide coverage, and Move (migration) is a one-time per-seat project charge rather than a recurring subscription.

German data-protection authorities have raised concerns about M365 in schools — does this help?

It reduces the added exposure a backup/audit tool would otherwise create. Because GTools.pro is zero-knowledge and the Desktop edition runs on-premise, it does not introduce a new readable copy of pupil data in a vendor cloud. It does not, however, resolve the underlying question of using Microsoft 365 itself — that remains your institution’s assessment.

Can we archive a graduating cohort’s data?

Yes. GTools.pro produces point-in-time exports to storage you control, so you can archive a cohort’s mail, OneDrive and Teams data before offboarding the accounts.

Microsoft 365 backup for schools
education Microsoft 365 backup
Bildungseinrichtungen Microsoft 365 Backup
pupil data protection M365
free Microsoft 365 backup school

Why it matters for Bildungseinrichtungen

Microsoft 365 backup and audit for schools and universities — pupil data protected, budgets respected, free for a single administrator.

Compliance drivers

Pupil/student data protection (GDPR). Pupils are frequently minors, whose personal data warrants heightened protection under the GDPR; a tool the vendor cannot read keeps that data inside the institution’s control. GDPR Recital 38 (children) — gdpr-info.eu
State DPA assessments of M365 in schools. German state data-protection authorities have repeatedly raised concerns about using Microsoft 365 in schools with pupils’ personal data; keeping backup/audit data on-premise (Desktop) or zero-knowledge reduces the added exposure a third-party tool would create. Datenschutzkonferenz (DSK)

Sector challenges and how GTools.pro answers them

School and university IT budgets do not accommodate open-ended per-seat subscriptions across thousands of accounts. The Solo tier is permanently free for a single administrator, and Move is a one-time per-seat project charge — pay once, own it.
Pupil data in Teams, OneDrive and SharePoint needs protecting without adding a readable vendor cloud. Zero-knowledge by default; the Desktop edition keeps all backup and audit data on the institution’s own machine.
Graduating cohorts and departing staff leave data to archive and accounts to offboard. Point-in-time exports you control for archival, plus lifecycle and audit tooling to review access before offboarding.

Microsoft 365 workloads that matter here

Exchange Online (staff + student mail)
Teams chat + channels (classes, coursework)
OneDrive / SharePoint (coursework, records)
Entra ID (account lifecycle, offboarding)

Recommended editions

Solo (free). Permanently free for a single Microsoft 365 administrator — start protecting data at zero cost.
Move (migration). One-time, per-seat migration for consolidations and cohort archival — paid once, when the move happens.

Limitations & out-of-scope — what GTools.pro is not for in Education

GTools.pro is an administrator toolkit, not a learning-management system or a substitute for your institution’s decision about whether to use Microsoft 365 with pupil data at all. It does not provide legal advice, and it does not include per-student self-service. The free Solo tier is single-user, single-tenant; tenant-wide coverage requires a paid edition. Restore is a manual operator action.

This page is general information, not legal, tax, or regulatory advice.

About the platform

This is a zero-knowledge toolkit. It helps IT admins, MSPs, security teams run their cloud safer. Use it inside a browser. Or install our Mac or Windows app.

Tenant credentials and vault contents are encrypted in your browser; the server holds ciphertext it cannot open. What the server can read is listed at /trust: account and billing metadata, OAuth tokens during the sign-in handshake, license tokens, migration job metadata, opt-in crash reports, redacted operational logs, and cloud export output for your plan's retention window.

How it works

You unlock a local vault with a passphrase. Argon2id stretches it.
Credentials get sealed with XSalsa20-Poly1305 before any sync.
X25519 protects shared keys. Ed25519 signs every action.
Each operation runs against Graph from your device, not ours.

What you can do

Back up mail. Files. Chat threads.
Export Intune settings. One click.
Audit SharePoint shares. Spot risk.
Find idle sites. Reclaim quota.
Score Copilot. Plan rollout.
Move tenants. No staging.
Client-side keys. Always on.
Your data. Your disk.
One app. Many tenants.

Editions

Solo. Free. Three tools. No card.
Backup. Durable backups for your tenant.
Watchtower. Audits and alerts on risk.
Move. Tenant migration suite.
Blueprint. Config export for enterprise.
Everything. Full platform plus desktop and support.

Trust signals

Open source crypto primitives via libsodium.
Public threat model at /trust.
Public pricing. Direct purchase. No sales call.
Cancel any time inside settings.
EU-based billing. Card payments via Stripe. PayPal for the Backup edition.

Built in Germany by Voltage Brothers Infrastruktur UG. Suits cloud workspaces of every size.

Standards, hosting, retention

Hosting: Germany. One region. Retention scales from 7 days. Up to 365 days by plan. Schedules run hourly. Daily. Weekly. Monthly. Reports export as JSON. CSV. PDF. Evidence packs bundle hashes. Chain-of-custody metadata sits beside them.

Standards: SOC 2 Type II is on the roadmap and is not yet attested. No ISO 27001 certificate; the audit tool maps findings to ISO 27001 controls. NIS2 mapping. GDPR Article 28 terms. Audit logs cover entitlement events. Billing actions. License rotations. Workload payloads never reach a remote log.

Who uses it

Tenant admins running a single estate.
MSPs managing dozens of customer cloud workspaces.
Security teams investigating sharing risk.
Compliance officers preparing audit evidence.
Acquisition teams during M&A integration.
Procurement teams reviewing vendor risk.
Solo consultants billing by workspace hour.

Hosting

One production server in Germany (Hetzner). No region selection. Customers range from small studios up through multinational estates. Payment: Stripe card checkout for every paid edition; PayPal additionally for Backup.

Numbers worth knowing

49 capabilities. 6 editions.
Free tier: 3 tools. 0 cards.
Argon2id. 256 MB memory cost.
XSalsa20-Poly1305. 256-bit cipher.
X25519. 256-bit shared keys.
Ed25519. 100% of writes signed.
Retention: 7 days up to 365 days. Set by plan.
Founded 2024. Built in Germany.
Backup edition: 14 EUR per user per year.
Watchtower edition: 7 EUR per user per year.
Move edition: 9 EUR per migrated seat. One-time. 450 EUR project minimum.
Blueprint edition: 449 EUR per tenant per year.
Everything bundle: 2490 EUR per tenant per year.
Audit collectors: 24 dedicated checks.
Config export: 9 Microsoft 365 workloads.
Migration record set in April 2026. 153,584 files. 0 errors.
Compliance posture updated in 2026.
Pricing: 1 public page. 0 sales calls.
Cancellation: 1 self-service page.
Audit logs: 90 days. Entitlement events.
GDPR Article 28. 27 member states.
NIS2 Directive. 18 sectors. Live since 2024.
SOC 2 Type II: on the roadmap. Not yet attested.