Microsoft 365 backup you can prove is restorable.

We announce it at least twelve months in advance and then publish the Business and Service Provider modules as open source under the core's license, Apache 2.0. Your installation keeps running without a license key.

Not for licenses bought in the pre-sale: they include every update of the 1.x series. From version 1.0, a license includes 12 months of updates; after that, an optional update year costs €295 (Business) or €595 (Service Provider) net, bought one year at a time and never renewed automatically. Without one, every version released until then keeps running with all modules, but older versions get no security fixes. After a gap, the next update year costs the normal price, with no back payment.

Wherever you point Restow: local storage, S3-compatible object storage, NFS. If your IT service provider runs Restow for you, they tell you where. Restow itself never stores your data on our infrastructure. Where a backup lands is named on the guest, machine and file share pages and in the job editors, with a warning when that is a directory on the server's own disk.

An Entra ID app registration that your tenant administrator consents to once, with Graph application permissions scoped to backup and restore. Alternatively, since 0.2.2, a source can use a Graph app that your tenant administrator creates in your own tenant. Restow only uses Graph, never EWS (Microsoft began switching EWS off for Exchange Online on 1 October 2026) and never legacy authentication. SharePoint Online backup needs the added application permission Sites.ReadWrite.All (Sites.Read.All is enough to back up, not to restore) and a new consent from your tenant administrator. The exact list is in the documentation.

Yes, with limits, since 0.1.0. Every edition, Community included, has the archive: an append-only store with a SHA-256 hash chain, chain verification (every link, the daily anchors and optionally a sample of message contents), export, reading and download as .eml, and search over subject, addresses and the body text of imported mail, with filters by sender, date and mailbox (attachments are not searched). It is filled by mail import with archiving; since 0.3.1 there is an archive per mail job, and since 0.4.2 the mail job editor first asks whether a job backs up, archives or both. Business and Service Provider add the layer designed for GoBD-compliant use: Exchange Online journal receipt over SMTP and, since 0.4.4, copies that a mail provider forwards (both capture in transport; the receiver needs a TLS certificate of your own, and journal reports are assigned to the mailboxes they name), enforced retention and legal hold. Since 0.4.4 they also capture from the mailboxes: Microsoft 365 by Graph change notifications and IMAP and Google Workspace by IMAP sync, each with a one-time takeover of the mail already there and one archived item per mail however many ways captured it. That capture is near-time and not complete (a mail moved or deleted right after delivery can be missed) and was tested against simulated services, not against a real Microsoft 365 or Google Workspace tenant. A mail job that archived before 0.4.4 keeps journaling only until an administrator switches another way on. Since 0.4.0 an administrator can turn on immutability per repository: S3 Object Lock locks the packs, manifests and keys of the chunk store, and on local directories and NFS shares a deletion delay makes Restow's own code refuse to delete or overwrite, which protects against misuse of Restow but is not immutability by the storage. It is off until turned on and was tested against a simulated S3, not a real service. The archive is designed for GoBD-compliant use, not certified. Self-service archive search for end users is planned.

Yes, on Linux and macOS, in every edition including Community. The backups run on restic, the well-known open-source backup program, so each machine's backup is a regular restic repository that restic itself can open with the machine's repository password, even without Restow. You run one install command on the machine; the script asks for a one-time token without showing it, checks the signature of the agent release and installs the agent in a folder only root can change. The agent connects outbound over HTTPS only and can add backups but never delete them. Restores go into a new folder or a ZIP download, and a restore test reads sampled files back and compares hashes. A running backup can be stopped from the web app (since 0.4.2) and ends as cancelled, not as failed. Windows, filesystem snapshots and disk images (bare-metal restore) are not available yet: the agent backs up files. They are planned, without a date. A Windows file server can be backed up without an agent as an SMB file share. Agent policies set a backup window, catching up missed backups, an upload limit, AC power and retries per installation, tenant or backup job. restic is an independent open-source project (BSD-2-Clause, restic.net); Restow is not affiliated with it.

Yes, since 0.4.0, in every edition including Community. Restow mounts an SMB share (Windows Server, Samba, a NAS) or an NFS export read-only for one run from the server, without an agent on the file server, and backs it up with restic into a repository of its own, keeping NTFS permissions. Every new restore point is checked by reading sampled files back, and a running backup can be cancelled from the run drawer. You can restore as a ZIP, into a new folder, to the original location or into another share, with permissions where the target allows it. It was tested against Samba in the release smoke run, not against Windows Server, a Synology or TrueNAS share or real NFS exports, and files that are open with an exclusive lock are skipped, because there is no VSS over SMB.

Yes, as a preview since 0.3.1, in every edition including Community. Restow backs up virtual machines and containers on Proxmox VE 8.4 and newer through Proxmox's Backup Provider API: VM disks over NBD with dirty bitmaps, so only changed 4 MiB blocks are uploaded, and containers through restic. A restore creates a new VMID in the pool restow-restore. Since 0.3.2 one command connects a node. The node side is a storage plugin shim (a separate work under AGPL-3.0-or-later) and the helper restow-pve (Apache-2.0). Since 0.4.0 it also shows the progress of running backups, can boot the newest restore point of a guest in isolation as a boot test, and browses and downloads files of containers and, as a preview of its own, VMs. Since 0.4.2 a queued or running backup can be stopped from the web app, every new restore point is read back within minutes of its backup, and a container whose repository went missing begins a new backup chain. It is a preview: it was tested against qemu-nbd, qemu-img and restic and, for the newer functions, against the simulated node of the test suites, not against a real Proxmox VE cluster. It is not yet recommended as the only backup.

Two things, both since 0.4.0 and in every edition, and neither is a virus scanner. Immutable backups, off until an administrator turns them on per repository: S3 Object Lock (compliance or governance) keeps the storage itself from deleting locked data until the lock has run out, and for local directories and NFS shares a deletion delay makes Restow's own code refuse to delete or overwrite, which protects against misuse of Restow but not against someone with access to the server. Ransomware detection judges every new restore point from data the backup already has (amount of change, mass deletions, renamed or known ransomware extensions, ransom notes, encrypted-looking files) and, while a finding is unresolved, pauses retention so that clean older restore points are not pruned. It never blocks a backup. Object Lock was tested against a simulated S3 and the detection with simulated attacks, not with real ransomware, and the installation's default repository cannot be made immutable.

EML, MSG, MBOX (Thunderbird, Apple Mail) and MailStore exports in EML or MSG form can be imported as a legacy mailbox that you can browse, restore into Microsoft 365 or IMAP, download and optionally archive. PST and OST files are recognised and refused with an explanation; PST and OST import is planned. MailStore's internal archive format cannot be read, so export from MailStore first.

Not unless you switch it on. The update check is off until an administrator turns it on, and then only reads the release list of the source you chose (the public GitHub releases by default). An optional updater, a separate Compose profile, can apply an update with a database backup first and an automatic rollback; since 0.4.0 the update dialog asks what to do with backups that are running (stop them cleanly, wait for them, or do not wait), and since 0.4.2 an update can be planned for a chosen date and time, and Proxmox VE nodes and agents follow a server update while new runs wait, 15 minutes at most. The rollback applies only while the database migrations have not run; after a migration the updater stops, keeps the dump and tells you how to restore it. It needs the Docker socket, which is root on the host, so read the trade-off in the documentation before you enable it.

Every release comes as two builds, full and Community, in four images (restow, restow-web, restow-community, restow-web-community), each built for amd64 and arm64, signed with cosign and shipped with an SBOM; the documentation shows the command that verifies a signature. Every agent release is signed by the maintainer with an Ed25519 key, and the installer and the agent check that signature before they run anything; on a first install, compare the release key fingerprint the installer prints with the published one, SHA256:2LB7RPpIS0wqbcZ2NA8MjuQN7ZfFPqBX3CwrGFSu76o (also in the release notes). Before a release is published, a smoke run has to pass for both builds: fresh install, restores with hash comparison, endpoint backup, mail import, file share backup against Samba. The Microsoft 365 check against a dev tenant (check 4) is not active yet: it was skipped in every release so far. In the release checks, the agent installer runs in a Linux container only.

The core is open source under the Apache License 2.0, on GitHub. The Business and Service Provider modules are licensed under the Restow license terms.

Yes, at demo.restowbackup.com: two fictional tenants with synthetic mail and 30 days of history. Browsing, statistics, backups, restore checks and restoring as a download work; restoring into a mailbox and changing sources, settings or users are locked. Everything resets every night at 03:00, and no visitor IP address is stored.