Immutable, encrypted backup for Microsoft 365 and Google Workspace — purpose-built for MSPs. Every account gets its own encryption key, your own S3 storage, and instant point-in-time search & restore.
Total workload coverage
Why Ark
Not just another connector. Ark is built around isolation, ownership, and provable recovery — the things that matter when the data is someone else's.
Every tenant's data is encrypted with its own AES-256 key — one account's key can never read another's bytes. Keys are sealed under a master key you control.
Point each account at any S3-compatible provider — Wasabi, AWS, Vultr, Backblaze B2, Cloudflare R2 or MinIO. Your data lives in storage you own and control.
A full-text index across every snapshot finds any message or file in milliseconds. Restore a single email, a folder, or a whole mailbox to a point in time.
Automated nightly backups with unlimited retention. Browse any account exactly as it looked on any date — incrementals make it fast and cheap.
Every run reconciles what's in the live source against what's captured, before and after. Coverage gaps are surfaced and auto-healed — never silently lost.
Email contents stay masked until an explicit reveal — and every reveal and download is recorded with who, what and when. Access without a trail is impossible.
How it works
Authorize Microsoft 365 or Google Workspace with least-privilege app access. No agents, no endpoints.
Ark captures every workload nightly — parallelized per mailbox — and stores it encrypted in your S3 bucket.
Each snapshot is reconciled against the live source. Integrity is proven, not assumed; shortfalls self-heal.
Search across all snapshots and restore in place — back to the original mailbox, or anywhere you choose.
Security & compliance
Tenant boundaries aren't a setting you trust — they're enforced in storage, in encryption, and in the database itself.
Streaming chunk encryption with a unique key per account.
Row-level security means a query can't cross tenant lines, even by mistake.
Every content reveal and download is logged — who, what, when, from where.
Retries that never give up and persistent checkpoints — no backup is half-finished.
Built for MSPs
Manage a whole portfolio of clients from a single pane — each one fully isolated, each with its own storage and keys, each scoped so your team only sees what they should.
Add clients in minutes and switch between them instantly. Scoped logins mean a technician sees only the accounts they manage.
Recurring partner commissions and the PlutoVault experience behind it. Bill the client; we handle the platform.
Each client can keep their backups in their own cloud account — clean data residency and cost ownership.
Get started
Join the PlutoVault partner program and bring immutable Microsoft 365 & Google Workspace backup to every client you manage.