SaaS Backup Services

Summary

Private and Public SaaS Backup is blueAPACHE's managed backup service for data held in cloud applications, giving organisations an independent copy and a recovery path that does not depend on the retention built into each SaaS platform. It is delivered from blueAPACHE's emPOWER Cloud platform in Australian data centres and contracted through a Service Order under blueAPACHE's General Terms and Conditions v3.6. One SaaS-style backup product is published in detail, emPOWER Backup for Microsoft Entra ID, powered by Veeam; other platforms are covered as agreed on the Service Order. This page describes what the service adds beyond native SaaS retention, the contractual backup obligation, what blueAPACHE does not publish, and the terms to settle before signing.

Key facts

What is included

The origin page describes managed backups for business data stored in cloud applications, reducing the risk of accidental deletion, retention gaps and data loss and giving a clearer recovery path for SaaS information. The service adds an independent, blueAPACHE-held copy to whatever the SaaS vendor retains natively.

The one SaaS backup product documented in detail is emPOWER Backup for Microsoft Entra ID. Its brochure describes automated, scheduled backup of Entra ID users and groups, roles and role assignments, application registrations, and directory and access configurations, with granular recovery of individual identity components, a browser-based SaaS-like experience, and identity data stored on blueAPACHE's private cloud within Australia. It is fully managed: operated, secured and supported end to end by blueAPACHE, and delivered as part of the managed services framework. The brochure's rationale is Microsoft's shared responsibility model: Microsoft secures the Entra ID platform, the customer remains responsible for its identity data and configuration, and native recovery is limited.

Contractually, where the Schedule includes backups, clause 3.14 obliges blueAPACHE to run the backup software at the agreed intervals and to re-run after addressing the root cause of any failure the software reports. Restoration returns the version of Customer Data that existed at the time of the relevant backup.

What is not included

SaaS platforms that are not named in the Schedule or Service Order are not backed up, and clause 17.3 confirms blueAPACHE has no backup obligation for anything not set out there. No list of supported SaaS applications beyond Microsoft Entra ID is published; coverage of Microsoft 365 mailboxes, SharePoint, OneDrive or third-party SaaS is defined per engagement.

The Entra ID brochure publishes no backup frequency, retention period, Recovery Point Objective or Recovery Time Objective, and these must not be inferred from Veeam product defaults. SaaS backup is not disaster recovery: it does not restore a running service within a Restore Time Objective, which is the separate emPOWER IT Continuity Services (DRaaS). It also does not change the customer's own obligations under clause 17.1 for the lawfulness and record-keeping compliance of its data.

Who it is for

Organisations that rely on Microsoft 365 and other SaaS platforms for daily operations and need recoverability beyond native retention; organisations with identity resilience concerns, since the Entra ID brochure frames identity as the primary attack vector; organisations with legal or regulatory retention obligations longer than a SaaS vendor's default; and organisations that need SaaS backup data held in Australia. blueAPACHE positions the service for customers who want one accountable partner across backup, recovery and ongoing support.

How it is delivered

Onboarding follows the Transition In Services in clause 8: due diligence on the platforms to be protected, monitoring configuration, support documentation and an agreed reporting schedule. For Entra ID, the brochure describes scheduled, automated backups run by blueAPACHE with recovery initiated through a browser-based interface, granular to individual identity objects. Customers must maintain the SaaS licences and administrative access that let blueAPACHE perform the service, and must promptly report any suspected security compromise (clauses 7.1 and 3.19).

The Managed Services brochure names backup among the help desk's technical disciplines and lists backup and disaster recovery solutions in the integrated support ecosystem, so restore requests from a Managed Services customer go through the same desk as other incidents.

Commercial model

Contracted on a Service Order with fixed fees monthly in advance and any usage-based components monthly in arrears, subject to Minimum Spend, with direct debit as the default payment method and GST additional (clause 12). No published per-user or per-mailbox rate exists for SaaS backup. Where the SaaS vendor or Veeam changes its charges to blueAPACHE, clause 12.5 allows the fee to be varied in the same proportion without a signed Variation.

Support and service levels

Platform support is stated as 24x7 in the emPOWER Cloud brochure, and Managed Services customers receive the unlimited 24/7 help desk with an Australian-based desk in business hours and follow-the-sun coverage after hours. Service Levels are only those stated under the "Service Level" heading in the Service Description, measured by blueAPACHE's tools, and subject to the Reasonable Excuse carve-out, which includes outages caused by third-party software used by blueAPACHE. Monthly reports arrive within five Business Days of month end, and the parties review the Services every six months. No service credit regime exists in the general terms.

Related services

Offsite Backup as a Service protects infrastructure and file data; Disaster Recovery as a Service restores whole workloads to an agreed RTO; Storage as a Service (Private S3) provides the immutable storage tier for long-retention archives. Human Risk Management and Managed Detection and Response address the phishing and identity attacks that make SaaS and identity backup necessary in the first place. The Microsoft Practice hub covers the Microsoft 365 and Entra ID environment the backup protects.

Evidence

• emPOWER Backup for Microsoft Entra ID brochure: the published blueAPACHE SaaS-style backup service, Veeam-powered, Australian-hosted, with granular recovery of identity objects.
• Vendor partnerships: blueAPACHE cited as Veeam Leading Partner of the Year 2018 and part of Microsoft's Qualified Multitenant Hoster programme.
• Pathology provider: long-retention health records moved from tape to blueAPACHE storage protected across three data centres, evidence of the platform's use for regulated retention.

Buying questions

Contract term and renewal. 36-month Minimum Service Period by default (clause 2.6); Written Notice by executed Service Order to renew or exit; otherwise a three-month holdover at full list price with Service Levels off (clause 2.9).

Termination. Customer: unremedied breach after 20 Business Days, blueAPACHE insolvency or ceasing business (clause 24.1). blueAPACHE: non-payment after five Business Days, specified breaches after 20 Business Days, insolvency, change of control (clause 24.2). Early Termination Payment under the Schedule; unmet minimums due immediately (clause 25.2).

Scope. Name every SaaS platform, tenant and data type to be protected, the backup frequency and retention period, and the restore granularity. Anything not on the Service Order carries no backup obligation and no data-loss liability.

Third-party terms. Under clauses 3.20 to 3.24 the customer is bound by the SaaS vendor's and backup software licensor's terms whether or not they have been shown, and blueAPACHE may have to terminate that part of the Service if the customer breaches them.

Exit. blueAPACHE deletes Customer Data from its environment at the end of the Service Period and the customer must take its own copy first (clause 9.1); agree an export format and window for backup sets.

Data protection. Mutual Privacy Act compliance, 24-hour eligible data breach notification, standing overseas transfer consent in clause 18.3, and the customer's warranty that no GDPR-regulated personal data is provided (clause 18.6).

Defining the SaaS data boundary

Specify applications, tenants, users and data types covered. Record retention and restore requirements for deleted users, changed permissions and records needed after account closure. Platform availability differs from recovery of a particular item. Identify restore authority and application validation. The service name does not establish coverage of every SaaS product or every object within a supported product.

Which document defines the commitment

The published General Terms v3.6 give the Service Order precedence over the General Terms, followed by the Schedules and then the Acceptable Use Policy (clause 2.3). Record the agreed scope, exclusions and negotiated departures in that document set. A brochure or a procurement discussion does not, by itself, define the customer-specific commitment. Keep the versions supplied at signing with the executed order and signed variations. Two offers with the same service name can cover different systems, operating hours or responsibilities.

Confidential information and access

Clause 16 provides mutual confidentiality protection. It covers information marked confidential, information identified orally and confirmed in writing within 30 days, and information that should reasonably be understood to be confidential. Customer Data, Customer Records and Customer Software are included; blueAPACHE’s agreement and fees are also confidential. Permitted disclosures include appropriately bound personnel on a need-to-know basis and specified professional advisers, with other exceptions in the clause. Identify who may receive operational reports, configuration details and commercial information. Access to information to deliver the service is not a general permission to circulate it.

Responsibility across the delivery chain

The published terms allow blueAPACHE to subcontract all or part of the Service Agreement without customer consent or a notification requirement. Clause 27.5 nevertheless makes blueAPACHE liable for its subcontractors’ acts and omissions to the same extent as for its employees. This differs from a third-party supplier contracted directly by the customer. Identify which arrangement applies to each dependency in the design. Where supplier identity, delivery location or change notification matters, request a documented supplier list and put any agreed notification or approval requirement in the Service Order; the general clause does not supply that visibility automatically.

How liability differs from service performance

Clause 19 separates performance obligations from financial liability. The general cap per claim is the greater of the fees paid in the preceding three months or $25,000, with exclusions and specific categories governed separately. Confidentiality, information security, privacy and the IP indemnity have a $1 million per-event and $2 million aggregate cap. Data-loss liability depends on whether blueAPACHE had, and breached, a contracted backup or disaster recovery obligation; the relevant measure is restoration cost to the applicable recovery point, not the value of every business consequence. Read these provisions alongside the negotiated Service Order and Schedule; an availability statement does not describe the liability regime.

Checking charges and preserving an invoice dispute

The General Terms require payment of the invoiced amount by its due date even while an amount is disputed. The customer has 60 Business Days from the invoice date to notify an error in writing, with its calculation and evidence. A dispute about blueAPACHE’s subsequent determination requires a Dispute Notice within 10 Business Days. Missing the required windows can waive the right to correction, subject to the fraud exception. Overdue amounts attract the published margin of four per cent over the RBA Cash Rate, calculated daily. Reconcile ordered quantities, approved changes and billed usage promptly; do not wait for a periodic service review to raise a billing error.

Sources and scope

The contractual detail above summarises the published General Terms and Conditions v3.6, using the KB documents on service agreement formation and document precedence; confidentiality; subcontracting and assignment; liability and indemnity; late payment and invoice disputes. The customer’s Service Order, Schedules and agreed variations determine the specific engagement. See the terms and conditions guide and Service Agreement.

Related

• Cloud pillar hub
• Microsoft Practice hub
• emPOWER Cloud
• Offsite Backup as a Service
• Disaster Recovery as a Service
• Storage as a Service (Private S3)
• Managed Detection and Response
• Human Risk Management
• Case study: Archers The Strata Professionals
• Industry: Professional services
• Industry: Financial services
• Service Agreement terms
• Support
• Contact blueAPACHE

Frequently asked questions

Does Microsoft already back up our Microsoft 365 and Entra ID data?

Not in the sense of an independent, long-term copy. blueAPACHE's Entra ID brochure explains the shared responsibility model: Microsoft secures the platform, the customer remains responsible for its identity data, configurations and policies, and native recovery capabilities are limited.

Which SaaS platforms can blueAPACHE back up?

emPOWER Backup for Microsoft Entra ID is documented in detail. Other private and public SaaS platforms are covered as agreed on the Service Order; blueAPACHE does not publish a universal supported-platform list.

What does emPOWER Backup for Microsoft Entra ID protect?

Users and groups, roles and role assignments, application registrations, and directory and access configurations, with granular restore of individual identity components. It is powered by Veeam and runs on blueAPACHE's private cloud within Australia.

How long is SaaS backup data retained?

As agreed in your Schedule and Service Order. blueAPACHE publishes no retention period, backup frequency, RPO or RTO for the service, and these should not be inferred from Veeam product defaults.

Where is the backup held?

On blueAPACHE's private cloud in Australian-based data centres, subject to Australian legal jurisdiction, according to the Entra ID brochure and blueAPACHE's data sovereignty statement.

Is SaaS backup the same as disaster recovery?

No. SaaS backup preserves an independent copy of application data and allows granular restores. Disaster Recovery as a Service (emPOWER IT Continuity Services) restores Customer Data and Software within an agreed Restore Time Objective.

What if a SaaS platform is not listed in our agreement?

Then blueAPACHE has no backup obligation for it under clause 17.3, the customer must keep its own backups under clause 3.15, and liability for loss of that data is excluded under clause 19.4(a)(i).

What happens if a backup job fails?

Under clause 3.14, where the backup software records a failure, blueAPACHE must address the root cause and re-run the backup until success is recorded. Ask how completion status is reported to you.

Who supports restore requests?

Backup is one of the technical disciplines of the emPOWER Managed Services 24/7 help desk, and the Entra ID service is described as operated, secured and supported end to end by blueAPACHE. The emPOWER Cloud brochure states 24x7 platform support.

How long is the contract and how does it end?

36 months by default from the Service Commencement Date. Renewal or exit requires Written Notice before the period ends; early termination triggers an Early Termination Payment under the Schedule, and at exit blueAPACHE deletes Customer Data after the customer has taken its own copy.

Is the service certified?

The emPOWER Cloud platform it runs on is in scope of blueAPACHE's ISO/IEC 27001:2022 certificate 202507-118 as emPOWER Cloud Services (IaaS), and the Entra ID service is delivered as part of the certified emPOWER Managed Services framework.

Source

Drawn from blueAPACHE's published SaaS backup service page on the origin site; the emPOWER Backup for Microsoft Entra ID, vendor partner, Managed Services and Cloud brochures; the ISO 27001 certification record, data sovereignty and residency statement and cross-border data transfer record; the pathology provider storage case study; and the General Terms and Conditions v3.6 (backup and disaster recovery obligations, information security obligations, liability and indemnity, third-party software and licensor terms, customer obligations, service term renewal and minimum service period, termination rights, consequences of termination, transition-in and disengagement services, fees payment and invoicing, service delivery and service levels, reasonable excuse exclusions, reporting review and audit rights, and data protection and privacy). Retention, frequency, RPO, RTO, supported-platform lists and pricing are not published and are not inferred here.

Knowledge Base