Backup you can prove is restorable.

We announce it at least twelve months in advance and publish the Business and Service Provider modules under the AGPL. Your installation keeps running without a license key, and the AGPL core already released cannot be withdrawn.

Wherever you point Restow: local storage, S3-compatible object storage, NFS or SMB. If your IT service provider runs Restow for you, they tell you where. Restow itself never stores your data on our infrastructure.

An Entra ID app registration that your tenant administrator consents to once, with Graph application permissions scoped to backup and restore. Restow only uses Graph, never EWS and never legacy authentication. The exact list is in the documentation.

Yes, from 0.1.0. Every edition, Community included, archives Microsoft 365 and IMAP mail into an append-only store with a SHA-256 hash chain, chain verification and full-text search. Business and Service Provider add the layer built for German GoBD requirements: Exchange Online journaling over SMTP, enforced retention and legal hold. It is built for German GoBD requirements, not certified. Self-service archive search for end users is still in development.

Yes, on Linux and macOS, in every edition including Community. You paste one command with a one-time token into the machine; the agent connects outbound over HTTPS only and can add backups but never delete them. Restores go into a new folder or a ZIP download, and a restore test compares hashes. Windows, filesystem snapshots and disk images (bare-metal restore) are not part of 0.1.0: the agent backs up files.

EML, MSG, MBOX (Thunderbird, Apple Mail) and MailStore exports in EML or MSG form can be imported as a legacy mailbox that you can browse, restore into Microsoft 365 or IMAP, download and optionally archive. PST and OST files are recognised and refused with an explanation; PST and OST import is planned. MailStore's internal archive format cannot be read, so export from MailStore first.

Not unless you switch it on. The update check is off until an administrator turns it on, and then only reads the release list of the source you chose (the public GitHub releases by default). An optional updater, a separate Compose profile, can apply an update with a database backup first and an automatic rollback. It needs the Docker socket, which is root on the host, so read the trade-off in the documentation before you enable it.

Every release image is built for amd64 and arm64, signed with cosign and ships an SBOM; the documentation shows the command that verifies a signature. Before a release is published, a smoke run has to pass: fresh install, restores with hash comparison, endpoint backup, mail import. The Microsoft 365 check runs against a test tenant only when credentials are configured.

Yes. Everything outside the ee/ folder is AGPL-3.0 with the Restow Module Exception and is published on GitHub with the first public release. The Business and Service Provider features live in ee/ of the same repository under a source-available license: you can read and run the code, and using an edition feature in production needs a license key. Contributions need a CLA and a DCO sign-off.

Yes, at demo.restowbackup.com: two fictional tenants with synthetic mail and 30 days of history. Browsing, statistics, backups, restore checks and restoring as a download work; restoring into a mailbox and changing sources, settings or users are locked. Everything resets every night at 03:00, and no visitor IP address is stored.