Your data is your data
Your backup lives on storage you pick, local disk, S3, NFS or SMB, encrypted with a key only your organization holds, in an open format a small standalone tool can restore even without Restow running.
Most Microsoft 365 backup products put your backup data in the vendor's own cloud, under the vendor's own account, and there is nothing wrong with that as a business model. It is simply a different choice than Restow makes, and the difference is worth being specific about instead of gesturing at "the cloud" as if it were one thing.
Four concrete facts, not a slogan
- You choose where the bytes live. Local storage inside the same Docker container needs no extra service to start; or point Restow at S3-compatible object storage, NFS, or SMB instead. More than one storage target per organization is supported (a primary plus a copy). Restow itself does not operate a storage service. There is no "Restow cloud" your data could end up in even by accident. See storage and why this matters for more.
- Every chunk is encrypted before it leaves the server, AES-256-GCM, with a separate key per organization. On the self-hosted Community and Business editions, that key never leaves your infrastructure. On a Service-Provider-operated instance, the provider holds the installation's master key to operate the service and can technically decrypt tenant data with it, including outside Restow (for example with the offline standalone-restore tool). Reading and restoring inside Restow go through audited paths, written to a tamper-evident, hash-chained log (who, when, for whom, from which IP), but that log cannot see access performed outside Restow with the master key directly. Choose a provider you trust, and have that covered in your data processing agreement.
- The storage format is open and documented, not a proprietary container tied to a running Restow installation. A small standalone tool restores data from it even without a Restow server running at all. See how Restow is built for what the project's own testing discipline currently does and does not cover, and exit costs and vendor lock-in for what that guarantee is actually worth.
- No phone-home. Restow does not call home: no telemetry, no license server contacted at runtime, no connection to the maintainer's infrastructure. It only connects to what you configure: Microsoft 365, your IMAP servers, your storage and mail transport. Beyond that, only in public mode, Let's Encrypt for your own TLS certificate; only if you switch the update check on, the update source you chose; and only if you enable the optional updater, the registry it pulls images from (ghcr.io by default). Endpoint agents on your servers and laptops talk only to your own Restow.
What this is not
It is not a claim that self-hosting is risk-free: you are responsible for the server, the storage, and the backups of your backups, and that is a real operational cost, not a hidden one. It is not a claim that vendor-hosted backup is unsafe; several of the products compared on the vendor comparison pages have real compliance certifications and mature operations teams behind their storage. It is a statement about who has to trust whom, and how far that trust has to extend, when your backup product also happens to be the safety net for your primary system. With Restow, that answer is: your storage, your key, an open format.
It is also not a promise that Restow takes responsibility for your setup. The setup wizard starts with an operator notice that has to be accepted before anything else: hardware, storage, immutability (WORM), custody of the encryption keys and restore tests are the operator's responsibility. The archive is designed for GoBD-compliant use, while whether your overall procedure is compliant stays with you. And it is not a cloud service in disguise: the agents that back up your servers and laptops talk only to your own Restow, never to us.
Where the exit actually is
A backup you cannot get back out in a usable, documented format is harder to treat as genuinely yours. See the vendor comparisons for what export and exit actually look like at each of eight other products we could verify facts about; several are genuinely good on this point, and we say so.