Features

What Cloudhold backs up, how snapshots work, and what's honestly still stub.

CHCloudhold — Snapshot detail

Sample snapshot

Restore point · Microsoft 365

One snapshot, down to the file.

A single daily restore point, opened up: what it holds, how it is sealed, and how a user gets something back.

Covers

Mail · OneDrive · SharePoint

Sample

Integrity

Content-hashed manifest — every item checksummed

Sealed

Object-lock

Append-only — no delete or update path exists

Anomaly scan

Mass-encryption pattern check at backup time (Defend)

Clear — sample

Restore in three steps

Find it

Search your own files, emails, and records

Pick a restore point

Any daily snapshot inside your retention window

Restore it yourself

Scoped to what you are entitled to — no IT ticket

Honest scope: Cloudhold cannot restore data deleted before your first backup ran — which is why the first one matters.

Sample — illustrative snapshot detail.Immutable · content-hashed · self-service restore

Microsoft 365 backup

Mail, OneDrive, SharePoint via Graph delta queries. OAuth app-only auth. App registration in progress — not connected yet (see honest scope).

Google Workspace backup

Drive and Docs via domain-wide delegation and the changes feed. OAuth app registration in progress — not connected yet (see honest scope).

Salesforce backup

Objects and attachments via Bulk API 2.0 — because bad imports happen. Connected App registration in progress — not connected yet (see honest scope).

GitHub backup

Repos, issues, and PRs backed up off-platform. Working today via the GitHub API.

Immutable snapshots

Content-hashed manifests; WORM semantics — no delete or update path exists.

Per-user self-service restore

Scoped restores: users only get back what they're entitled to; everything else is reported denied.

Air-gapped copies

Complete and up: snapshots replicated to isolated object storage under object-lock.

Ransomware anomaly detection

Defend tier: mass-encryption pattern analysis at backup time with immediate admin alerts.

Restore API

List snapshots, fetch manifests, and run scoped restores programmatically.

Honest scope: what's real today

We'd rather tell you what's roadmap than let you discover it after signup.

Area	v1 reality
M365 / Google / Salesforce connectors	Recorded-fixture stubs in v1. Real OAuth implementations are the launch milestone — they slot into the same connector interface.
GitHub connector	Working today: real API + mock mode.
Storage backend	Local WORM store in v1; S3-compatible Object Lock backend is the launch milestone (maps 1:1).
Ransomware	We detect likely mass-encryption activity and alert you. We do not remove malware or replace EDR.
Endpoint backup	SaaS data only — no laptops, no servers.
Provider connections	No Google / Microsoft / Salesforce OAuth app registrations exist yet. Until a tenant has a real provider connection, backup jobs answer `provider_not_configured` — they never fake a backup, a snapshot, or a restore.
Tenant provisioning	Built 2026-10-21: Stripe webhook provisioning, `ch_live_…` tenant keys (stored hashed), one-time claim page, per-tenant seat records. Live deploy of the hosted API is a go-live step.
SMS alerts	Email is the v1 alert channel. SMS joins when an alert provider is connected — Defend copy says so wherever SMS is mentioned.