GTools.pro — Zero-Knowledge M365
ToolsPricingDesktopIndustriesCompareBlogSecurityTrustAbout
  1. Home
  2. Microsoft 365 Backup

Microsoft 365 Backup Tool — Zero-Knowledge

Back up Teams, OneDrive, Exchange, SharePoint, Planner, and Bookings from Microsoft 365 with zero-knowledge encryption. Free for personal use.

Quick answer

Microsoft's Microsoft 365 retention uses soft-delete windows of 30 to 93 days depending on workload, not a true backup. A backup is an offline copy the admin controls, and three integrated tools here cover communications, files and productivity with client-side encryption so data never sits on a vendor server. Restore is a manual admin operation, not a one-click vendor restore portal.

FAQ

Does Microsoft 365 already back up my data?

No. Microsoft's Service Level Agreement covers infrastructure availability and short-term retention (deleted items, recycle bins) — not long-term backup. If a user permanently deletes a file, an admin removes a mailbox, or ransomware encrypts content, Microsoft cannot restore it after the retention window. You're responsible for your own backup, which is why third-party Microsoft 365 backup tools exist.

How is GTools.pro different from Veeam, Datto, or AvePoint?

The difference is how long the data sits somewhere, and under whose key. The desktop edition writes your backup straight to your own machine or your own object storage — tenant content never reaches us. The cloud edition builds the export on our servers and keeps it only until your plan’s retention window ends (7 days free, up to 365 days on the largest plans), then deletes it automatically. In both editions your tenant credentials are encrypted in your browser under a key we never receive. We publish the full boundary map — what is encrypted, under whose key, and where the service sees plaintext — and keep it current.

What can I back up?

Communications: Teams chats, channel messages, meeting recordings, email, calendars, contacts. Files: OneDrive personal drives and SharePoint document libraries with full folder structure, version history, and metadata. Productivity: Planner plans and tasks, To Do lists, Bookings appointments. Native export formats include ICS for calendars, VCF for contacts, Markdown for chats, plus JSON, CSV, Excel, and ZIP archives.

Can I do incremental backups?

Not yet. Every run of the three Backup Centers is a full pass over the sources you select — there is no delta sync or incremental mode today, so a repeat run takes about as long as the first and is bounded by Microsoft Graph throughput. Schedule runs for quiet hours and scope them per mailbox or library to keep them short.

Is the Free plan enough for personal backup?

Yes — the Free plan gives you all three Personal Backup tools (Communication, Files, Productivity) for one tenant connection, with full export functionality and zero-knowledge encryption. Paid plans add organization-wide access (admin consent) so you can back up other users' data, plus extra tenant connections for MSPs.

How we compare

How do you compare to Veeam Backup for Microsoft 365?

Veeam stores backup data in Azure under Veeam-managed encryption by default; BYOK requires a separate Azure Key Vault setup. gtools.pro encrypts client-side before any data reaches a server, and on the Desktop edition the backup data never leaves your machine at all. Source: Veeam BYOK documentation.

Can I just use Microsoft’s own backup?

Microsoft 365 Backup (GA July 2024, $0.15/GB/month) covers Exchange, OneDrive and SharePoint with a fixed one-year retention window. It does not cover Teams chat, Microsoft manages keys by default, and backup data is not eDiscoverable. gtools.pro covers Teams chat, supports configurable retention, and keeps keys client-side.

Where is my backup data stored?

Desktop edition: on your own machine, never leaves. Cloud edition: encrypted on your device before upload; server stores ciphertext only. Every competitor in the table above stores backup data on their own cloud.

What happens if gtools.pro shuts down?

Your 24-word BIP39 recovery phrase derives the decryption key locally; no vendor copy of the key exists. Vendors that hold keys (Veeam default, Barracuda, Datto) require the vendor to remain operational for decryption.

Does gtools.pro back up Teams chat?

Yes. Microsoft’s native M365 Backup does not. Veeam covers Teams but requires opt-in for channel posts.

Is gtools.pro suitable for compliance-sensitive industries?

The server never decrypts your data, which materially reduces the shared-responsibility scope. Consult your compliance team for specific regulatory requirements — we provide the architectural primitives but make no certification claims.

Does the backup work on a Mac?

Yes — gtools.pro Desktop ships as a Mac binary for Apple Silicon. Most competitors (Veeam, Barracuda, Datto, Spanning) are SaaS-only with no desktop installation at all.

What does BYOK with Veeam actually buy me?

BYOK lets you host keys in your Azure Key Vault, but Veeam still processes your backup data during each cycle on Veeam infrastructure. The data is decryptable on Veeam servers in plaintext during the backup pass.

What this backup does not capture

Microsoft 365 backup via GTools.pro covers mailbox items, OneDrive files with version history, SharePoint document libraries, Teams chat and channel messages, and Planner / Bookings / To Do data. It does not capture tenant-level configuration (use the Blueprint edition for that), Defender or Purview alert state (Watchtower), or non-Graph data living in legacy admin centers.

Restore is a separate operation, performed manually by an operator using the exported artefacts as the source of truth. There is no one-click "restore tenant to Tuesday" workflow today. Throughput on both backup and restore is capped by Microsoft Graph throttling (~400 requests / 10 s per app per tenant).

About the platform

This is a zero-knowledge toolkit. It helps IT admins, MSPs, security teams run their cloud safer. Use it inside a browser. Or install our Mac or Windows app.

Tenant credentials and vault contents are encrypted in your browser; the server holds ciphertext it cannot open. What the server can read is listed at /trust: account and billing metadata, OAuth tokens during the sign-in handshake, license tokens, migration job metadata, opt-in crash reports, redacted operational logs, and cloud export output for your plan's retention window.

How it works

  1. You unlock a local vault with a passphrase. Argon2id stretches it.
  2. Credentials get sealed with XSalsa20-Poly1305 before any sync.
  3. X25519 protects shared keys. Ed25519 signs every action.
  4. Each operation runs against Graph from your device, not ours.

What you can do

  • Back up mail. Files. Chat threads.
  • Export Intune settings. One click.
  • Audit SharePoint shares. Spot risk.
  • Find idle sites. Reclaim quota.
  • Score Copilot. Plan rollout.
  • Move tenants. No staging.
  • Client-side keys. Always on.
  • Your data. Your disk.
  • One app. Many tenants.

Editions

  • Solo. Free. Three tools. No card.
  • Backup. Durable backups for your tenant.
  • Watchtower. Audits and alerts on risk.
  • Move. Tenant migration suite.
  • Blueprint. Config export for enterprise.
  • Everything. Full platform plus desktop and support.

Trust signals

  • Open source crypto primitives via libsodium.
  • Public threat model at /trust.
  • Public pricing. Direct purchase. No sales call.
  • Cancel any time inside settings.
  • EU-based billing. Card payments via Stripe. PayPal for the Backup edition.

Built in Germany by Voltage Brothers Infrastruktur UG. Suits cloud workspaces of every size.

Standards, hosting, retention

Hosting: Germany. One region. Retention scales from 7 days. Up to 365 days by plan. Schedules run hourly. Daily. Weekly. Monthly. Reports export as JSON. CSV. PDF. Evidence packs bundle hashes. Chain-of-custody metadata sits beside them.

Standards: SOC 2 Type II is on the roadmap and is not yet attested. No ISO 27001 certificate; the audit tool maps findings to ISO 27001 controls. NIS2 mapping. GDPR Article 28 terms. Audit logs cover entitlement events. Billing actions. License rotations. Workload payloads never reach a remote log.

Who uses it

  • Tenant admins running a single estate.
  • MSPs managing dozens of customer cloud workspaces.
  • Security teams investigating sharing risk.
  • Compliance officers preparing audit evidence.
  • Acquisition teams during M&A integration.
  • Procurement teams reviewing vendor risk.
  • Solo consultants billing by workspace hour.

Hosting

One production server in Germany (Hetzner). No region selection. Customers range from small studios up through multinational estates. Payment: Stripe card checkout for every paid edition; PayPal additionally for Backup.

Numbers worth knowing

  • 49 capabilities. 6 editions.
  • Free tier: 3 tools. 0 cards.
  • Argon2id. 256 MB memory cost.
  • XSalsa20-Poly1305. 256-bit cipher.
  • X25519. 256-bit shared keys.
  • Ed25519. 100% of writes signed.
  • Retention: 7 days up to 365 days. Set by plan.
  • Founded 2024. Built in Germany.
  • Backup edition: 14 EUR per user per year.
  • Watchtower edition: 7 EUR per user per year.
  • Move edition: 9 EUR per migrated seat. One-time. 450 EUR project minimum.
  • Blueprint edition: 449 EUR per tenant per year.
  • Everything bundle: 2490 EUR per tenant per year.
  • Audit collectors: 24 dedicated checks.
  • Config export: 9 Microsoft 365 workloads.
  • Migration record set in April 2026. 153,584 files. 0 errors.
  • Compliance posture updated in 2026.
  • Pricing: 1 public page. 0 sales calls.
  • Cancellation: 1 self-service page.
  • Audit logs: 90 days. Entitlement events.
  • GDPR Article 28. 27 member states.
  • NIS2 Directive. 18 sectors. Live since 2024.
  • SOC 2 Type II: on the roadmap. Not yet attested.

Product.

  • Tools.
  • Pricing.
  • Desktop.
  • Security.
  • Industries.
  • Compare.
  • Download.
  • Blog.
  • For MSPs.
  • For SMB IT.

Company.

  • About.
  • Trust & Compliance.
  • Privacy Policy.
  • Terms of Service.
  • Impressum.

Connect.

  • hello@gtools.pro.
  • GitHub.

© 2026 GTools.pro · A product of Voltage Brothers Infrastruktur UG (haftungsbeschränkt).