# AegisGrid – full content of aegisgrid.de in English > All English pages of aegisgrid.de as text. Provider: MSD Computersysteme GmbH, Germany. > As of: 2026-11-13 --- Source: https://aegisgrid.de/en/ Backup made in the EU # Backups you can trust. AegisGrid is more than backup and recovery: a backup system that backs up servers, virtual machines and Microsoft 365 deduplicated and encrypted, keeps working with the backups on the backup server, restores them as a test and proves every step with a signature. Developed in Germany. If you wish, we run it for you as Managed Backup, and for the off-site copy there is our cloud storage in Germany. Request a pilot project (https://aegisgrid.de/en/contact/?thema=pilot) See the features (https://aegisgrid.de/en/features/) - Developed in Germany - GDPR-compliant operation - AES-256 encryption - Immutable backups Backups of this nightAll successful - File server (Windows, VSS)02:14 - Hyper-V host, 6 VMs02:41 - Proxmox VE, 4 VMs03:05 - Microsoft 36503:30 - Copy to the cloud storage03:52 Sample view · two destinations, one read · encrypted in transit For everyone who carries responsibility ## One solution, three perspectives Management needs certainty, IT management a strategy that holds, and administrators a tool that works reliably every day. AegisGrid is built for all three. Management ### Keep working when it matters Protection against ransomware and data loss, signed evidence for GDPR, NIS2 and critical infrastructure, and a provider based in Germany. More for management (https://aegisgrid.de/en/solutions/management/) IT management ### A backup strategy that works out Several destinations in one run, immutable copies, regular checks and check restores – the 3-2-1-1-0 rule in one run, with proof. More for IT management (https://aegisgrid.de/en/solutions/it-management/) Administration & engineering ### Technology you can follow Content-defined deduplication, zstd compression, TLS with certificate pinning, VSS and LVM, Hyper-V, Proxmox VE, Xen and an HTTPS API. More for admins (https://aegisgrid.de/en/solutions/administrators/) AES-256-GCMor ChaCha20-Poly1305 – encrypted before the data leaves your premises Up to 8 destinationsin one run – local, at your own sites or in the data centre Ed25519signed updates and components – nothing unsigned is installed Germanydevelopment, operation and support from a single source Features ## Everything a backup has to do today Every backup is complete in itself and can be restored on its own – no chains of full and incremental backups that become useless when one link breaks. ### Deduplication Data is split into blocks by content; only what is not there yet is stored – across several computers, too. ### Encryption AES-256-GCM or ChaCha20-Poly1305 per store, transfer over TLS with a pinned server certificate. ### Protection against ransomware WORM storage with a retention lock: until the lock expires, backups can be neither changed nor deleted. If unusually many files change, AegisGrid warns and holds on to the older versions. ### Virtualisation Back up whole VMs from Hyper-V, Proxmox VE and Xen with all disks and their configuration, restore them as a new VM or, on Proxmox VE and Xen, reset them in place to an earlier version. ### Microsoft 365 Mailboxes with calendar, contacts and tasks as well as OneDrive and SharePoint – one by one or for the whole tenant. ### Provably intact Checks of all stored objects, automatic check restores that start the VMs in a sandbox, virus scans, and a signed log for NIS2 and BSI. **Backed up on the road, too:** if a notebook is closed, switched off or its battery runs flat, the backup carries on afterwards where it stopped. Notebooks and mobile workplaces (https://aegisgrid.de/en/solutions/notebooks/) All features at a glance (https://aegisgrid.de/en/features/) Backup system ## More than backup and recovery AegisGrid grows with your requirements – from a single computer to the data centre, with the same software. - ### Simply back up One computer, one USB disk or a NAS: to start with, you need neither a server nor a cloud. - ### 3-2-1-1-0 in one run The source is read once and up to eight destinations are written: local, immutable and off-site. About the rule (https://aegisgrid.de/en/solutions/it-management/) - ### A backup server that keeps working Incoming backups trigger jobs: check, mirror, export, clean up and restore as a test – starting the VMs in a sandbox. About the backup server (https://aegisgrid.de/en/backup-server/) - ### Provable for auditors A chained, signed log, a copy to your SIEM and a signed report every month for NIS2, critical infrastructure and BSI. About the evidence (https://aegisgrid.de/en/evidence/) Managed Backup ## We take care of it. You keep working. With AegisGrid Managed Backup, MSD Computersysteme GmbH from the EU does the installation, keeps the backup servers and backup agents up to date and regularly checks whether your backups can be restored. You decide where the backups are kept – at your premises, at a second site or in the AegisGrid cloud storage (https://aegisgrid.de/en/cloud-storage/). Discover Managed Backup (https://aegisgrid.de/en/managed-backup/) - **Operated by specialists in Germany** – permanent contacts, no offshore call centre. - **Installation and updates** – backup servers and agents always up to date. - **Restore tests** – checked regularly, with a record. - **Daily monitoring** – we see problems before they become emergencies. - **Guided restore** – in an emergency we work on it together with you. - **Data processing under Art. 28 GDPR** – with a contract, clearly arranged. Trust ## Why you can trust us Backups contain everything that makes up a company. Whoever processes them should be subject to the law that applies to you, too. ### German and European law Provider, development and operation in Germany. Your backup data is not transferred to third countries. ### Your keys stay with you Without the key, an encrypted store reveals nothing about its contents – not even to whoever runs the storage. ### Your data stays within reach Your licence works without a permanent connection to us. If it ends, only new backups stop – restoring from your own systems always works, and nothing is ever deleted because of a licence. ### People you can reach Development and support sit together. Questions reach the people who build the software. Partner programme ## Systems house, MSP or data centre? Become a partner. We are looking for IT service providers who want to offer their customers a backup made in the EU – as their own service or together with our Managed Backup and cloud storage. Data centres that provide backup servers for everyone are just as welcome. Every contribution counts: skills, involvement and customer revenue. We are building the partner programme now and shape it together with the first partners. To the partner programme (https://aegisgrid.de/en/partners/)Arrange a call (https://aegisgrid.de/en/contact/?thema=partner) ### What partners can expect - Your name, logo and contact in the setup, the consoles and the messages - Messages per customer to the customer, to you or to both - Several customers cleanly separated on one backup server - Training, mentoring and partner meetings - Support with pilot projects - Fair partner terms - A say in further development FAQ ## Answered briefly **What is AegisGrid?** AegisGrid is a backup system for businesses – more than backup and restore. It backs up files, whole drives, virtual machines (Hyper-V, Proxmox VE, Xen) and Microsoft 365 deduplicated and encrypted, from a single computer onto a USB disk up to your own backup server, which keeps working with the backups, restores them as a test and keeps a verifiable log. The provider is MSD Computersysteme GmbH in Germany. **Where are my backups kept?** Wherever you decide. AegisGrid backs up to local disks and NAS storage, to your own backup server on site or at a second location, to S3-compatible object storage, and exports to tape or USB disk – up to eight destinations in one run. For the off-site copy you can use the AegisGrid cloud storage (https://aegisgrid.de/en/cloud-storage/) in certified data centres in Germany if you wish. A cloud is not a requirement. **Is AegisGrid GDPR-compliant?** AegisGrid is developed in Germany. You decide where your backups are kept – on site, at a second site of your own or in the AegisGrid cloud storage, which is located exclusively in certified data centres in Germany. For cloud storage and Managed Backup, MSD Computersysteme GmbH concludes a data processing agreement with you under Art. 28 GDPR. Data is encrypted before it is transferred. **Which systems can AegisGrid back up?** Windows and Linux servers, workstations and notebooks (files, volumes and whole disks, consistent through VSS or LVM snapshots), virtual machines on Hyper-V, Proxmox VE and Xen, and Microsoft 365 with Exchange mailboxes, OneDrive and SharePoint. **Does AegisGrid protect against ransomware?** Yes. Backups can be kept in WORM storage with a retention lock; until the lock expires they can be neither changed nor deleted. In addition, a second copy can be written to another location in the same run. For file backups, AegisGrid warns when unusually many files have changed and then does not clean up the older versions; the check restore looks for traces of ransomware in the backups and, if desired, for viruses. **What does AegisGrid cost?** The cost depends on the scope and the way it is run (your own operation or Managed Backup, with or without cloud storage). We will gladly make you an offer – ideally as part of a pilot project in your environment. All questions and answers (https://aegisgrid.de/en/faq/) ## Try AegisGrid in your environment In a pilot project we back up selected systems together and restore them as a test. That way you see how AegisGrid works in your environment before you decide. Request a pilot project (https://aegisgrid.de/en/contact/?thema=pilot) +49 211 21099-0 --- Source: https://aegisgrid.de/en/about-us/ About us # Who is behind AegisGrid. AegisGrid is developed by MSD Computersysteme GmbH in Düsseldorf, Germany – an IT service provider that has been looking after mid-sized companies since 1990 and knows what backup feels like in everyday life and in an emergency. ## From practice, for practice For more than three decades we have been setting up servers, networks and backups for our customers and restoring them in an emergency. AegisGrid grew out of this experience: a backup system that does not just back up but proves that the restore works. Development, operation and support sit under one roof with us in Germany. Questions reach the people who build the software – not a queue. - **Founded:** 1990 - **Head office:** Grunerstraße 41, 40239 Düsseldorf, Germany - **Register:** Amtsgericht Düsseldorf, HRB 82077 - **Development and support:** our own staff in Germany - **Offers:** AegisGrid software, Managed Backup (https://aegisgrid.de/en/managed-backup/), cloud storage (https://aegisgrid.de/en/cloud-storage/), partner programme (https://aegisgrid.de/en/partners/) Management ## Uwe J. Solleder Uwe J. Solleder is the Managing Director of MSD Computersysteme GmbH. He writes the articles in the guides (https://aegisgrid.de/ratgeber/) (in German) – about what really concerns companies when it comes to backup, restore and evidence. You can find more about his career in his LinkedIn profile (https://www.linkedin.com/in/uwe-solleder). Get in touch (https://aegisgrid.de/en/contact/?thema=beratung) **Our standard:** backup is a matter of trust. That is why we only promise what AegisGrid can do today, and we show it to you in a pilot project on your own systems. ## Get to know us By phone, by email or at our office in Düsseldorf. Contact (https://aegisgrid.de/en/contact/) +49 211 21099-0 --- Source: https://aegisgrid.de/en/backup-server/ Backup server # The backup is done. The backup server keeps working. A plain backup program stores data and waits for the emergency. The AegisGrid backup server turns every incoming backup into the next step: check it, mirror it to a second location, export it to tape or USB disk, clean up, restore it as a test and inform the right people – automatically and traceably. Updated on 2026-11-13 Diagram in five steps: a backup arrives encrypted from the computer, is checked (new or all stored data), mirrored to a second backup server and restored as a test, with VMs starting in the sandbox; finally a report with screenshots goes out by email. Every step is recorded in the evidence log: chained, signed daily, sent straight to your SIEM if you wish. What the backup server does with an incoming backup – automatically and with proof.Swipe sideways to see the whole diagram. ## Process further, automatically - Jobs at the start, after the success or after the failure of a backup, a mirroring or a restore - Check all stored data, or only what was newly added - Mirror to a second backup server, at another site, for example - Copy of whole stores to S3-compatible object storage, immutable if wanted - Export of single backups as an archive for tape or USB disk - Clean up by the retention rules, also by generations (days, weeks, months, years) - Your own scripts for everything else ## Flows and dependencies - Flows of several steps that run one after the other – only on success or in any case - Waiting until certain backups or jobs have arrived - Schedules with public holidays per region, time windows and catching up on missed runs - Parallel jobs; whatever concerns the same store runs safely one after the other - Graphical view: which backup triggers which job - Sensible first jobs right after the installation ## Check restores in the sandbox - Backups are restored as a test, regularly or as a sample - File systems are checked and mounted read-only, per disk and partition - Every file is read and compared with the last check – read errors, files changed unnoticed and losses are reported - Signs of ransomware in the backup, such as files that look encrypted or ransom notes - Virus scan with ClamAV, read-only: the report names since which backup a finding has been present and which backup was the last one without it; signatures also for backup servers without internet access - Virtual machines start in an isolated environment without any connection to the outside - Dependent systems in order, the domain controller first, then the mail server, for example - One check report per check chain: traffic lights per disk and partition, screenshots of the started machines ## Messages to the right people - Errors, damage, missing backups, scarce storage and check reports - Per customer to its contacts for technical or commercial questions - For customers looked after by a partner, per kind of message to the customer, the partner or both - Clear texts with the next step, your own templates possible - Repeated messages are bundled instead of filling mailboxes - Recipients per kind of message, daily digest, preview and test email ## Target console and web interface - Several backup servers in one interface - Running backups with computer, progress and time left - Running restores, Microsoft 365 backups and mirrorings with their progress - Data, backup versions and retention per store - History with charts of usage, results and throughput - Edit jobs, flows and schedules, view the evidence - Create check chains graphically: dock steps to disks and partitions, traffic light and progress per step - Access through its own HTTPS API with roles for reading and managing - Without Windows in the browser: overview, sessions, storage, accesses and customers, jobs, mail and log through the built-in web interface ## Several customers on one server - Every access is bound to its directories - No customer sees the data or messages of another - Storage quotas per customer, with a notice before space runs out - Monthly evidence report per customer - Encrypted stores stay locked: checking, mirroring and cleaning up work without the key - Limits for CPU time, memory and disk access per job, so that no customer slows down the others - Usage measured per customer and job ## Prove that the restore works A backup is only worth something once it can be restored. The check restore checks this regularly without anyone having to lift a finger – every Saturday morning on three randomly chosen backups, for example. - ### Restore The backup server restores the newest backup or a sample into a test area of its own. - ### Check File systems are checked read-only; every file is read, compared with the last check of the same backup and examined for traces of ransomware and, if desired, for viruses. - ### Start Virtual machines boot in the sandbox; the check looks at whether they run, show a screen or whether their services answer. - ### Report and clean up The check report with traffic lights per disk and partition and screenshots goes out by email, is recorded in the evidence log, and the test area is emptied. ## Everything that happens is on record Every incoming backup, every restore, every job and every check restore is recorded in the evidence log of the backup server – chained, signed daily and, if you wish, handed to your SIEM at once. From it, a signed evidence report is created as a PDF every month. Evidence for NIS2 and BSI (https://aegisgrid.de/en/evidence/) **Starting small works, too:** for a single computer, a USB disk or a NAS is enough as the destination – without any backup server. The backup server comes in when several systems, a second site or evidence are needed. ## Questions about the backup server **Do I need a backup server?** No. AegisGrid also backs up straight to a local disk, a USB disk or a NAS. A backup server pays off as soon as several systems come together in one place, backups are to go to a second site, or verified restores and evidence are needed. **Where does the backup server run?** On a Linux server of your choice – on site, at a second site or as part of our cloud storage (https://aegisgrid.de/en/cloud-storage/). Several backup servers can be combined, one on site and one off site that mirrors the data of the first, for example. They are managed with the target console on Windows. **What does the check restore need?** Space for the restored data and, to start virtual machines, a backup server with hardware virtualisation (KVM). The check of the configuration names the packages needed. For encrypted backups, the backup server needs the key for the check restore; without it, checking, mirroring and cleaning up remain possible. ## See the backup server in your environment In a pilot project we set up further processing and check restores on your own systems. Request a pilot project (https://aegisgrid.de/en/contact/?thema=pilot) --- Source: https://aegisgrid.de/en/cloud-storage/ Cloud storage # The off-site copy in Germany. The AegisGrid cloud storage is a backup destination in certified data centres in Germany. You use it alongside your own destinations – whether you run AegisGrid yourself, through a partner or with our Managed Backup. Ask about cloud storage (https://aegisgrid.de/en/contact/?thema=cloud) ## One destination among several AegisGrid backs up to up to eight destinations in one run. The cloud storage is one of them – typically the off-site copy next to a fast copy on your premises. ### Encrypted before it leaves The data is encrypted on your systems with AES-256-GCM or ChaCha20-Poly1305 and transferred over TLS. Without your key, the content cannot be read. ### Only what is missing Thanks to deduplication, only what the cloud storage does not hold yet is transferred. Interrupted transfers carry on where they stopped. ### Immutable if you wish With a retention lock, backups can be neither changed nor deleted until the lock expires – not even by ransomware in your network. ## Your data stays in Germany The cloud storage is located exclusively in certified data centres in Germany and is operated by MSD Computersysteme GmbH with its own staff. No data is transferred to third countries. The basis is a data processing agreement under Art. 28 GDPR with the technical and organisational measures. - **Location:** certified data centres in Germany - **Operation:** MSD Computersysteme GmbH, Germany - **Encryption:** on your systems, TLS in transit - **Contract:** data processing under Art. 28 GDPR - **Restore:** straight from the cloud storage ## Questions about the cloud storage **Do I need Managed Backup for it?** No. Every AegisGrid customer can use the cloud storage as a destination – in their own operation, through a partner or together with Managed Backup (https://aegisgrid.de/en/managed-backup/). **Do I have to use the cloud storage?** No. AegisGrid backs up just as well to local disks, NAS storage, your own backup servers on site or at a second site, and exports to tape or USB disk. The cloud storage is an offer for everyone who does not want to run a second site of their own for the off-site copy. **Is the cloud storage suitable for notebooks?** Yes. Notebooks reach the cloud storage over the internet without having to be in the company network, and they continue interrupted backups. More under Notebooks and mobile workplaces (https://aegisgrid.de/en/solutions/notebooks/). **What does the cloud storage cost?** Prices on request. We will gladly make you an offer that fits your amount of data. ## An off-site copy without a second site Without obligation and in person – we discuss the amount of data, retention and connection with you. Ask about cloud storage (https://aegisgrid.de/en/contact/?thema=cloud) +49 211 21099-0 --- Source: https://aegisgrid.de/en/comparison/ Comparison # AegisGrid in a factual comparison There are many good backup solutions. Which one fits depends on your environment, your requirements and your stance on data protection and the vendor's origin. This overview sets verifiable features side by side – with sources. Updated on 2026-11-07 ## Features at a glance Information on other products according to publicly available vendor information, as of October 2026. The scope of functions may differ by edition and version. --- Source: https://aegisgrid.de/en/contact/ Contact # Let's talk about your backup Whether a pilot project, Managed Backup, cloud storage, a partnership or a technical question – write to us or give us a call. You reach people, not a queue. We answer in English or German. --- Source: https://aegisgrid.de/en/evidence/ Evidence · NIS2 · critical infrastructure · BSI # Backed up is good. Provably backed up is better. Anyone who falls under NIS2, operates critical infrastructure or works to BSI IT-Grundschutz has to be able to show that backups run, are kept and are restored. For this, the AegisGrid backup server keeps a log that cannot be changed unnoticed – and turns it into a signed report every month. Updated on 2026-11-07 Diagram: four entries of one night in the evidence log – 01:12 backup received, 02:40 check without findings, 03:05 check restore passed, 03:31 backup deleted per retention rule. Each entry carries the SHA-256 checksum of its predecessor. All entries of the day come together in the daily seal, an Ed25519 signature; right afterwards the backup server checks the chain and reports any discrepancy by email. Copies go to a SIEM or syslog server (every entry at once) and to a second backup server (every sealed day). The chain in the evidence log: every entry carries the checksum of its predecessor, every day is signed.Swipe sideways to see the whole diagram. ## What is recorded - Every incoming backup and mirroring with computer, address and amount of data - Every restore and every check restore with its result - Every job with its trigger: schedule, event, previous job or who started it - Interventions in the data: deleted backups, changed retention, space freed - Damage found and backups rejected because of a quota - The server's clock: daily time synchronisation, jumps are noted ## Chained and sealed - Every entry carries the SHA-256 checksum of its predecessor – across all days - Every day is signed with its own Ed25519 key and checked right afterwards - The server reports a deviation by email at once - Entries go to disk immediately; gaps after a crash are noted - Kept for ten years by default – and never shorter than the oldest existing backup ## A copy in a second place and to the SIEM - Every entry at once to your syslog server or SIEM (RFC 5424, over UDP, TCP or TLS) - In addition or instead, every sealed day to a second backup server that checks it and stores it immutably - A differing second version of a day is rejected and reported - If the other side fails, nothing is lost: the transfer catches up ## Report and export for auditors - Monthly evidence report as a PDF: backups, failures, restores, check restores, interventions, damage - With the state of the log and the mapping to the requirements - Signed and sent by email to the operator, also per customer if you wish - Export as CSV for Excel or as JSON, filtered by period, kind, customer or directory - Every export and every report can be checked against its signature - In the target console: the log with filters, “Check chain”, export and report with one click ## 3-2-1-1-0 in one run – and proven The BSI recommends the 3-2-1 rule: three copies, two media, one off site. The 3-2-1-1-0 rule adds an immutable copy and zero errors in the check. With AegisGrid this happens in a single run: the source is read once and up to eight destinations are written at the same time – a USB disk, a WORM backup server on site and a backup server off site, for example. Every copy on a backup server is recorded there in the evidence log. The regular check of all data and the check restore prove the “0” – both logged as well and included in the monthly report. The 3-2-1-1-0 rule in detail (https://aegisgrid.de/en/solutions/it-management/) - **3 copies** – up to eight destinations in one run - **2 media** – disk, NAS, backup server, tape or USB disk - **1 off site** – second site or cloud storage - **1 immutable** – WORM with a retention lock - **0 errors** – check and check restore, proven ## What the log proves The evidence report contains the same mapping. | Requirement | Content | What AegisGrid proves | | NIS2 Directive Art. 21(2)(c) | Backup management and disaster recovery | Every backup, every restore, every check restore with its result, checks and damage | | BSI IT-Grundschutz CON.3 | Backup concept | Regularity and completeness of the backups, retention, deletions, restore tests | | BSI IT-Grundschutz OPS.1.1.5 | Logging | Tamper-proof log with chain, seal, time synchronisation and a copy in a second place | | Critical infrastructure operators | Proof of appropriate precautions to the authority | The same records as a signed report and export for audits | The report supports the proof. Whether an organisation meets the requirements depends on more than the backup – on the concept, the organisation and further measures. We will gladly advise you on what makes sense for your company. ## Questions about the evidence **Do we automatically comply with NIS2 with AegisGrid?** No, no software alone makes a company NIS2-compliant. For the area of backup and restore, AegisGrid provides solid, signed records. They are one building block of your overall concept. **Does the log replace a SIEM?** No, it complements your SIEM. Every entry can go to your SIEM at once via syslog (RFC 5424, also encrypted over TLS) and be evaluated there together with other events. The log on the backup server also remains as a verifiable source. **Is a backup to a USB disk recorded in the log, too?** The backup server keeps the evidence log of what arrives and happens there. A backup straight to a USB disk or a NAS reports its result in the log of the backed-up computer and by email. Whoever needs evidence additionally writes to a backup server in the same run. **What is not in the log?** The evidence log is about the data: what was backed up, restored, checked, deleted or changed. Logins to the server and changes of the configuration are in the system log of the server. ## Would you like to see a sample report? We show you the log and the evidence report in a conversation or in a pilot project on your own systems. Arrange a call (https://aegisgrid.de/en/contact/?thema=beratung)Request a pilot project (https://aegisgrid.de/en/contact/?thema=pilot) --- Source: https://aegisgrid.de/en/faq/ FAQ # Questions and answers The most important questions about AegisGrid, answered briefly and factually. Your question is not among them? Write to us. ## General **What is AegisGrid?** AegisGrid is a backup system for businesses – more than backup and restore. It backs up files, drives, virtual machines (Hyper-V, Proxmox VE, Xen) and Microsoft 365 deduplicated and encrypted, from a single computer onto a USB disk up to your own backup server, which keeps working with the backups, restores them as a test and keeps a verifiable log. The provider is MSD Computersysteme GmbH in Germany. **Who is behind AegisGrid?** AegisGrid is a brand of MSD Computersysteme GmbH, an IT service provider from Germany that has been looking after companies since 1990. Development, operation and support come from a single source. More about us (https://aegisgrid.de/en/about-us/) **Which companies is AegisGrid suited for?** For small and mid-sized companies, practices, law firms and organisations that want to back up their servers, virtual machines and Microsoft 365 reliably and in line with data protection – in their own operation or as Managed Backup. **What does AegisGrid cost?** The cost depends on the scope and the way it is run. We will make you an offer, ideally after a pilot project in your environment. **Which languages is AegisGrid available in?** Programs, consoles, messages, e-mails and reports are available in English, German, Spanish, French and Croatian. AegisGrid follows the language of the system; in the consoles, every Windows user chooses their own language. New and improved translations arrive with the updates. Every message carries a fixed number, so it can be identified clearly in any language. ## Technology **Which systems can AegisGrid back up?** Windows servers (2016, 2019, 2022 and 2025) and Linux servers as well as workstations and notebooks with Windows 10 and 11 (files, volumes, partitions and whole disks, consistent through VSS or LVM snapshots), virtual machines on Hyper-V, Proxmox VE (LVM, LVM-thin, ZFS, Ceph RBD and qcow2) and Xen, and Microsoft 365 with Exchange Online mailboxes, OneDrive and SharePoint. **What happens if a backup is interrupted?** AegisGrid carries on where the backup stopped. After a lost connection or standby it reconnects and continues the same backup; after a power-off, a flat battery or a crash it picks it up again by itself at the next start. Only what is still missing is transferred, and an incomplete backup never results. More under Notebooks and mobile workplaces (https://aegisgrid.de/en/solutions/notebooks/). **What does deduplication mean?** Deduplication means that identical data is stored only once. AegisGrid splits data into chunks by content and only stores chunks that the destination does not hold yet. That saves storage space and bandwidth – also between different computers. **How does AegisGrid encrypt?** With AES-256-GCM or ChaCha20-Poly1305, set per store. The data is encrypted on the backed-up system before it is written or transferred. The transfer to the backup server additionally uses TLS. **Where are my backups kept?** Wherever you decide. AegisGrid backs up to local disks and NAS storage, to your own backup server on site or at a second location, to S3-compatible object storage, and exports to tape or USB disk – up to eight destinations in one run. For the off-site copy you can use the AegisGrid cloud storage (https://aegisgrid.de/en/cloud-storage/) in certified data centres in Germany if you wish. A cloud is not a requirement. **Can AegisGrid back up to several destinations at once?** Yes, to up to eight destinations in one run, for example to a local NAS, to your own backup server at a second site and to the AegisGrid cloud storage. The source is read only once. **How does AegisGrid protect against ransomware?** With WORM storage: backups are written with a retention lock and can be neither changed nor deleted until it expires. An additional copy at another location and the regular check of the stored data complete the protection. For file backups, AegisGrid warns when unusually many files have changed and then does not clean up the older versions; the check restore on the backup server can also scan the backups for viruses. **Can I get single deleted files back?** Yes. AegisGrid backs up files and folders with their permissions. To get a file back, you search for it by name across all versions, see its versions and choose the right one; it goes to its original location, to another folder or out as a ZIP archive. A version can also be opened as a read-only folder, on Windows and Linux. In the management console you tick the files you need. **Which operating systems does AegisGrid run on?** Agent, restore, job scheduler and updates run on Windows and Linux, the backup server on Linux. On Windows there are also the management console and the target console for backup servers; job scheduler and backup server can also be operated in the browser from any computer. On Linux, Debian, Ubuntu, Red Hat Enterprise Linux, AlmaLinux, Rocky Linux, SUSE Linux Enterprise Server and openSUSE Leap are tested; the versions are listed in the specifications (https://aegisgrid.de/en/specifications/). **Can I simply back up to a USB disk?** Yes. A USB disk, an internal disk or a NAS is enough as the destination, without any backup server. In the same run, a copy can additionally go to a backup server or the cloud storage. Single backups can also be exported as an archive to tape or USB disk. **What does the backup server do with my backups?** It keeps working with them: it checks them, mirrors them to a second location, exports them, cleans up by the retention rules, restores them as a test and starts virtual machines in an isolated sandbox. Results go to the responsible contacts. More about the backup server (https://aegisgrid.de/en/backup-server/) **How do I prove backups to auditors?** The backup server keeps a chained, daily signed log of backups, restores, check restores and deletions. From it, a signed evidence report is created as a PDF every month; entries can additionally go to your SIEM at once via syslog. This supports evidence for NIS2, critical infrastructure and BSI IT-Grundschutz. More about the evidence (https://aegisgrid.de/en/evidence/) **Can we get at our data when the licence expires?** Yes. After a licence ends, only new backups stop. Existing backups on your own backup servers and destinations can still be restored, and nothing is ever deleted because of a licence. The licence is stored signed on your systems; a backup does not fail because our licence server is temporarily unreachable. ## Data protection and operation **What is Managed Backup?** A service of MSD Computersysteme GmbH for running your backup: installation, updates of the backup servers and backup agents, monitoring and regular checks of whether the backups can be restored. Where the backups are kept is independent of this – at your premises, at a second site or in the cloud storage. More under Managed Backup (https://aegisgrid.de/en/managed-backup/). **Where is the AegisGrid cloud storage located?** Exclusively in certified data centres in Germany, operated by MSD Computersysteme GmbH with its own staff. Every AegisGrid customer can use it as a destination, with or without Managed Backup. More under Cloud storage (https://aegisgrid.de/en/cloud-storage/). **Is there a data processing agreement?** Yes. For Managed Backup and the cloud storage we conclude a data processing agreement with you under Art. 28 GDPR. **What is a pilot project?** In a pilot project we back up selected systems together with you and restore them as a test. This way you see before deciding how AegisGrid works in your environment and how long a restore takes. **Can my IT service provider look after AegisGrid?** Yes. We are building a partner network of systems houses and managed service providers. Your service provider can run AegisGrid itself or combine it with our Managed Backup. The name and contact of your service provider then appear in the setup, the consoles and the messages, and messages go to you, to them or to both, as agreed. ## Any more questions? We answer personally – not with text blocks. Ask a question (https://aegisgrid.de/en/contact/) --- Source: https://aegisgrid.de/en/features/ Features # What AegisGrid can do More than backup and recovery: a backup system for servers, virtual machines and Microsoft 365 – deduplicated, encrypted, to several destinations at once, processed further on the backup server, restored as a test and logged with proof. From a USB disk to the data centre. Updated on 2026-11-13 Diagram of four levels rising from left to right: Level 1 “Simply back up” – one computer, one USB disk or a NAS, no server and no cloud. Level 2 “3-2-1-1-0 in one run” – read once, up to eight destinations: local, immutable, off-site. Level 3 “A backup server that keeps working” – check, mirror, export, restore as a test. Level 4 “Provable for auditors” – signed log, copy to the SIEM, monthly report as a PDF. From a single computer to the data centre – with the same software.Swipe sideways to see the whole diagram. ## Back up - Files, volumes, partitions, whole disks and images - Content-defined deduplication across all backups of a store - Every version complete and restorable on its own, without backup chains - Free space (NTFS, ext2/3/4) and zero areas are not stored - Compression with zstd or lz4 - Parallel processing for high throughput ## Consistency and platforms - Windows with VSS shadow copies - Linux with LVM snapshots - Pre/post hooks for databases and applications - Hyper-V: whole VMs, application-consistent, with change tracking - Proxmox VE (LVM, LVM-thin, ZFS, Ceph RBD, qcow2) and Xen: whole VMs with their configuration - Proxmox VE with fast follow-up backups (CBT): after the first backup, only what changed in the VM is read - Xen with memory if wanted: the restored VM carries on where it stood at the backup - Microsoft 365: Exchange Online, OneDrive, SharePoint ## Back up files and folders - Choose folders and files in a tree, with your own and sensible default exclusions - Permissions and owners included: NTFS permissions, POSIX ACLs, extended attributes - Windows with VSS and the change journal: only what has changed is read - Linux with an LVM snapshot or live, detecting files that change while they are read - Deduplicated together with the disk and VM backups of the same store - Warning when unusually many files have changed – older versions are then not cleaned up ## Get single files back - Search by name across all versions, optionally for a period of time - Every version of a file and the comparison of two versions - To the original location, to another folder or as a ZIP archive - Open a version as a read-only folder, on Windows and Linux - Tick files and folders in the management console - Single files from disk and VM backups as well, on Windows and Linux, without restoring the disk first ## Security - AES-256-GCM or ChaCha20-Poly1305 per store - Encryption before transfer, the key stays with the customer - TLS with a pinned server certificate - API keys bound to directories - Backup server with separated privileges - Ed25519-signed updates and components ## Protection against loss and tampering - WORM storage with a retention lock - Simply back up straight to a USB disk or a NAS – without a backup server - Up to eight destinations in one run: local disk, NAS, your own backup server at a second site, the AegisGrid cloud storage or S3-compatible object storage - On S3 always encrypted, immutable through S3 Object Lock if wanted - Mirroring of whole stores to a second location - Export of single backups as an archive for tape or USB disk - Retention per destination, also by generations (days, weeks, months, years) - Extend the retention of single backups on purpose, for an audit, for example ## Check and restore - Check of all stored objects (scrub) - Comparison of a backup with its snapshot (Linux) - Repair from a second copy - Partial restore of damaged backups - VMs as a new VM or disk by disk, straight from the server - Reset Proxmox and Xen VMs in place to an earlier version; the previous disks are kept until the restore has succeeded - Write back only changed blocks – much faster after a small change - Host set up anew: VMs come back with their old VMID or name and their MAC addresses - Restore wizard in the management console: a drive or a VM back step by step, with the destination checked first - Restore in the background - Check restore on the backup server: VMs start as a test in an isolated sandbox - Restore from your own backup servers and destinations even after the licence has expired - Virus scan of the backups in the check restore, naming the last backup without the finding ## Plan and operate - Job scheduler as a Linux and Windows service, parallel jobs - Schedules with public holidays per region, time windows and catching up on missed runs - Dependencies between jobs, schedule editor and the schedule in words - Results by email; changes through the API with the changed lines - Failed jobs are retried automatically, with a warning when a job has not succeeded for too long - Entries in the Windows event log for monitoring - Management console for Windows; release to the consoles of the other computers in the company - Web interface for job scheduler and backup server: operation in the browser, without Windows and without additional software – also for pure Linux, Proxmox and Xen environments - Programs, consoles, messages, e-mails and reports in English, German, Spanish, French and Croatian; new translations arrive with the updates - HTTPS API to create, start, pause and monitor - Pause running backups and continue at the same point, bandwidth limit - Resumption after standby, power-off or a lost connection - Jobs on a schedule or by hand only - Updates hold running backups and continue them afterwards - Wizard for new jobs: source, destinations and schedule in three steps - After installation, the setup leads straight to the first backup - F1 opens the online manual at the matching section - Notice of virtual machines that no job backs up yet ## Backup server that processes backups further - Jobs on incoming backups, on a schedule or one after the other in flows - Check, mirror to a second location, copy to S3, export, clean up, your own scripts - Check restore: check file systems, read every file, report signs of ransomware, start VMs; check report with traffic lights and screenshots - Messages per customer to the customer, the partner or both - Several customers cleanly separated, quotas per customer - Target console for Windows with history and a graphical editor for flows and check chains - Operation in the browser as well, through the built-in web interface - Limits for CPU time, memory and disk access per job; usage measured per customer More about the backup server (https://aegisgrid.de/en/backup-server/) ## Evidence for NIS2, critical infrastructure and BSI - A log of everything that happens to the data - Chained with SHA-256, every day signed with Ed25519 - Copy to a SIEM via syslog (RFC 5424, also over TLS) or to a second backup server - Signed evidence report as a PDF every month, also per customer - Export as CSV or JSON for auditors More about the evidence (https://aegisgrid.de/en/evidence/) ## Interruptions cost no work If a backup is interrupted – because a notebook is closed, the battery runs flat, a computer shuts down or the connection drops – AegisGrid carries on afterwards where it stopped. After a lost connection it continues the same backup; after a power-off it picks it up again by itself at the next start. Only what is still missing is transferred, and a backup only counts as finished once it is complete. Resumption is always switched on. Even a deliberately held backup carries on at the same point: virtual machines keep their checkpoint or snapshots, finished disks and files are not read again, and the backup keeps the moment of its first start. Back up notebooks on the road (https://aegisgrid.de/en/solutions/notebooks/) **Especially for large amounts of data over slow lines:** even a first backup that does not run through in one go reaches its destination safely over several stages – without starting from scratch each time. ## Your own operation or Managed Backup You can run AegisGrid yourself – on your own servers, with your own backup server and your own destinations. Or you leave the operation to us: with Managed Backup we do the installation, the updates of the backup servers and backup agents and regular restore tests, wherever your backups are kept. As the destination for the off-site copy, the cloud storage in certified data centres in Germany is also open to you. Managed Backup (https://aegisgrid.de/en/managed-backup/)Cloud storage (https://aegisgrid.de/en/cloud-storage/)Technical details (https://aegisgrid.de/en/solutions/administrators/) **Does AegisGrid fit your environment?** On Proxmox VE, AegisGrid backs up virtual machines on LVM, LVM-thin, ZFS, Ceph RBD and qcow2 files; snapshots of single Linux servers are taken through LVM. In a pilot project we check beforehand whether all your systems are covered. ## See for yourself We show you AegisGrid on your own systems. Request a pilot project (https://aegisgrid.de/en/contact/?thema=pilot) --- Source: https://aegisgrid.de/en/glossary/ Glossary # Terms of data backup In short: the most important terms around backup and recovery, each in two or three sentences – explained in general, with a note on how AegisGrid implements it. Updated on 2026-11-11 - **3-2-1 rule** Three copies of the data, on two different media, one of them off site. The German Federal Office for Information Security (BSI) recommends this rule as the basis of every backup. - **3-2-1-1-0 rule** An extension of the 3-2-1 rule: in addition, one immutable or disconnected copy (the second “1”) and zero errors in the tested restore (the “0”). AegisGrid writes to up to eight destinations in one run. More in the guide (https://aegisgrid.de/en/guides/3-2-1-1-0-rule/) - **Agent** The program on the computer being backed up that reads, splits, encrypts and writes the data to the destinations. The AegisGrid agent runs on Windows and Linux. - **Air gap** A copy without a permanent connection to the company network, such as a disconnected USB disk or a tape. What cannot be reached cannot be encrypted by an attacker. - **Backup server** A server that accepts and stores the backups of several computers. The AegisGrid backup server also processes them further: it checks, mirrors, exports and cleans them up and restores them as a test. More about the backup server (https://aegisgrid.de/en/backup-server/) - **Check restore** An automatic test restore: the backup is restored to a test area, file systems are checked, files are read and VMs are started in an isolated environment. The result is recorded in a check report. More in the guide (https://aegisgrid.de/en/guides/testing-restores/) - **Deduplication** Identical data is stored only once. AegisGrid splits the data by content (FastCDC) into chunks of 256 KiB on average and stores only chunks that are not yet in the store – across all backups and computers. - **Destination (sink)** A place a backup is written to: local disk, USB disk, NAS, backup server, S3 object storage or cloud storage. AegisGrid writes to up to eight destinations in one run and reads the source only once for this. - **Differential backup** Backs up everything that has changed since the last full backup. Not needed with AegisGrid: thanks to deduplication every restore point is complete, yet only new data is transferred. - **Encryption (end-to-end)** The data is encrypted on the computer being backed up before it leaves it; the key stays with the customer. AegisGrid uses AES-256-GCM or ChaCha20-Poly1305. - **Evidence log** A tamper-evident log of backups, restores, checks and deletions. In AegisGrid it is chained with SHA-256 and signed daily with Ed25519. More about evidence (https://aegisgrid.de/en/evidence/) - **GFS (grandfather-father-son)** Retention by generations: daily, weekly, monthly and yearly restore points, each kept for its own period. This keeps a few old restore points for a long time without keeping every day. - **Incremental backup** Backs up only what has changed since the last backup. Traditionally this creates a chain that must be complete for a restore. AegisGrid also transfers only changes, but stores every restore point completely, without a chain. - **Mirroring** A complete copy of a store at a second location, for example on a backup server at another site. Only what is still missing there is transferred. - **Ransomware** Malware that encrypts data and demands a ransom; modern attacks go after the backups first. Immutable and disconnected copies and tested restores protect against it. More in the guide (https://aegisgrid.de/en/guides/ransomware-backup/) - **Restore point** The state of the backed-up data at one point in time; every backup creates a restore point. In AegisGrid every restore point is complete and can be restored on its own. - **Resume** An interrupted backup continues where it stopped instead of starting over. Always active in AegisGrid, also after standby, shutdown or a lost connection. - **Retention** The rule for how long backups are kept before they are cleaned up – by days or by generations. Configurable per destination in AegisGrid. - **RPO (recovery point objective)** How much data loss is acceptable at most, measured as time: with an RPO of 24 hours, backups must run at least daily. - **RTO (recovery time objective)** How long a system may be down at most until it is restored. The RTO determines how fast the restore must be and whether it has been tested. - **Scrub** A check of all stored objects against their checksums, so that silent damage to the storage is noticed before it is needed. With a second copy, AegisGrid repairs damaged chunks. - **Shadow copy (VSS)** The Windows Volume Shadow Copy Service freezes the state of the drives while work continues. On Windows, AegisGrid always backs up from a shadow copy. - **Snapshot** A frozen state of a drive or VM at one point in time, backed up while the system keeps running. On Linux AegisGrid uses LVM snapshots, on Proxmox VE the snapshots of the respective storage. - **Store** The area where AegisGrid keeps the deduplicated chunks and restore points. Encryption, chunk IDs and retention apply per store. - **WORM (write once, read many)** Once written, neither changeable nor deletable until a lock expires. On the AegisGrid backup server, the server enforces the lock against all computers being backed up. ## Questions about your backup? We are happy to explain it using your own environment. Get in touch (https://aegisgrid.de/en/contact/) --- Source: https://aegisgrid.de/en/guides/ Guides # Backup, explained clearly. What the law really requires, which rules have proven themselves and how to recognise a good backup – from the practice of an IT service provider that has been looking after businesses since 1990. 2026-11-07 ## Scanning backups for viruses: restore clean Malware detected today has often been sitting in the backups for weeks. How to find it there – and the last clean backup.Read the article (https://aegisgrid.de/en/guides/scanning-backups-for-viruses/)2026-11-07 ## Restoring a deleted file from the backup Find the right restore point, compare versions and get the file back without overwriting the current one – step by step.Read the article (https://aegisgrid.de/en/guides/restore-deleted-file/)2026-11-07 ## Proxmox Backup Server or AegisGrid? A comparison What both do for Proxmox VE, where Proxmox Backup Server is stronger and when AegisGrid fits – together, too.Read the article (https://aegisgrid.de/en/guides/proxmox-backup-server-or-aegisgrid/)2026-11-07 ## Backing up a file server: shares and permissions Consistent despite open files, with permissions, fast incremental runs and a warning when suddenly a very large number of files change.Read the article (https://aegisgrid.de/en/guides/file-server-backup/)2026-11-07 ## An Acronis alternative from the EU: a comparison When AegisGrid is an alternative to Acronis Cyber Protect and when Acronis is the better fit – factual and with sources.Read the article (https://aegisgrid.de/en/guides/acronis-alternative/)2026-10-30 ## Backup plan: a guide with checklist Which questions a backup plan has to answer – from RPO and RTO to the sealed emergency envelope for the key – and a checklist to tick off.Read the article (https://aegisgrid.de/en/guides/backup-plan/)2026-10-27 ## A Veeam alternative from the EU: a comparison When AegisGrid is an alternative to Veeam and when it is not – factual, with sources and honest about the limits.Read the article (https://aegisgrid.de/en/guides/veeam-alternative/)2026-10-27 ## Testing restores: only the test counts Why “backup successful” does not mean the restore will work – and how check restores run automatically and with evidence.Read the article (https://aegisgrid.de/en/guides/testing-restores/)2026-10-27 ## Ransomware: backups that survive an attack Attackers delete the backups first. How immutable copies, separate permissions and an offline copy save the restore.Read the article (https://aegisgrid.de/en/guides/ransomware-backup/)2026-10-27 ## Backing up Proxmox VE: consistent and encrypted Consistent snapshots with the guest agent, LVM, ZFS, Ceph and qcow2, UEFI and vTPM – what matters when backing up Proxmox VMs.Read the article (https://aegisgrid.de/en/guides/proxmox-ve-backup/)2026-10-27 ## NIS2 and backup: what you have to prove Backup management and recovery are mandatory under NIS2. What that means in concrete terms, who is affected and what auditors want to see.Read the article (https://aegisgrid.de/en/guides/nis2-backup/)2026-10-27 ## Microsoft 365 backup: the recycle bin is not a backup How long Microsoft 365 keeps deleted items, why that does not replace a backup and what matters for a GDPR-compliant backup.Read the article (https://aegisgrid.de/en/guides/microsoft-365-backup/)2026-10-27 ## Backing up field staff laptops reliably In the background, over slow connections, despite closed lids and flat batteries – how laptops are backed up reliably on the road.Read the article (https://aegisgrid.de/en/guides/laptop-backup/)2026-10-27 ## Hyper-V backup: application-consistent and complete Recovery checkpoints, VSS in the guest, change tracking, vTPM and Guardian – what matters when backing up and restoring Hyper-V VMs.Read the article (https://aegisgrid.de/en/guides/hyper-v-backup/)2026-10-27 ## Backup under the GDPR: what you need to consider Recoverability, encryption, storage location, data processing and deletion periods – what the GDPR requires of backups.Read the article (https://aegisgrid.de/en/guides/gdpr-backup/)2026-10-27 ## The 3-2-1-1-0 rule: backup strategy explained simply Three copies, two media, one off-site, one immutable, zero errors – what the rule means and how to put it into practice.Read the article (https://aegisgrid.de/en/guides/3-2-1-1-0-rule/) ## Your question is not covered? We are happy to answer it personally – and it often becomes the next article. Ask a question (https://aegisgrid.de/en/contact/?thema=beratung) --- Source: https://aegisgrid.de/en/guides/3-2-1-1-0-rule/ Guide · Backup strategy # The 3-2-1-1-0 rule explained simply In short: keep three copies of your data on two different media, one of them off-site and one immutable – and check that all of them can be restored without errors. The rule extends the well-known 3-2-1 rule, which Germany's Federal Office for Information Security (BSI) also recommends, with protection against ransomware and a tested restore. By Uwe J. Solleder (https://aegisgrid.de/en/about-us/#uwe-solleder), Managing Director of MSD Computersysteme GmbH · Published on 2026-10-27 · updated on 2026-11-01 ## The five digits | Digit | Meaning | What it protects against | | 3 copies | The original data and at least two backups | Failure of a single backup | | 2 media | At least two different kinds of storage, such as disks in the server and a NAS or backup server | Faults that affect a whole class of device | | 1 off-site | One copy at a different location | Fire, water, theft, power surges | | 1 immutable | One copy offline or locked against changes and deletion | Ransomware and attackers with administrator rights | | 0 errors | Tested and restorable | Backups that do not work when they are needed | ## Why 3-2-1 is no longer enough The 3-2-1 rule dates from a time when hardware faults and accidents were the biggest risks. Today attackers go after the backups on purpose: before ransomware encrypts the data, it deletes or encrypts every backup it can reach. An off-site copy only helps if the attacker cannot delete it with the same credentials. Hence the additional **1** for an immutable copy. The **0** reflects the experience of many emergencies: backups that had been reported as “successful” for years could not be restored – because a disk was missing, a service did not start or the key had been lost. Only a test shows whether a backup is any good. ## An example from practice A company with a Hyper-V host, a file server and Microsoft 365 implements the rule like this: - **Copy 1:** every night to a NAS in the server room – for quick everyday restores. - **Copy 2:** in the same run to a backup server with a WORM lock in another fire compartment or at a second site – immutable for 30 days. - **Off-site:** the backup server mirrors at night to a second backup server off-site or to cloud storage in Germany; in addition, a weekly export to a USB disk that is kept in a safe. - **Zero errors:** every Saturday three randomly chosen backups are restored as a test, their file systems checked and the VMs started in an isolated environment. All of this is recorded in the backup plan (https://aegisgrid.de/en/guides/backup-plan/) – together with retention, responsibilities and where the key is kept. ## The most common mistake: several runs instead of one Many environments meet the rule with several separate backups – one local, a second to the cloud, later a copy job. That costs time in the backup window, puts load on the systems several times and leads to copies with different states. Better is one run that reads the source once and writes to all destinations at the same time. ## How AegisGrid implements the rule AegisGrid reads the source once and writes **to up to eight destinations in one run**: USB disk, NAS, an on-site backup server with a WORM lock, an off-site backup server or the cloud storage (https://aegisgrid.de/en/cloud-storage/). Each destination only receives what it is still missing. For the **0**, the backup server (https://aegisgrid.de/en/backup-server/) checks all stored data and automatically restores backups as a test. Every copy on a backup server, every check and every check restore is recorded in the signed evidence log (https://aegisgrid.de/en/evidence/). Diagram: the server fs01 is read once. AegisGrid deduplicates and encrypts the data and sends each destination only what it is missing: to a USB disk on site, to a backup server on site with a WORM lock until expiry and to a backup server off site or the cloud storage – up to eight destinations in one run. Below it the rule: 3 copies (original and destinations), 2 media (disk and server), 1 off site (second location), 1 immutable (WORM lock), 0 errors (check, check restore). Read once, up to eight destinations: the 3-2-1-1-0 rule in a single run.Swipe sideways to see the whole diagram. ## Frequently asked questions about the 3-2-1-1-0 rule **Does the cloud count as “off-site”?** Yes, if the copy is in a different building and cannot be deleted with the same credentials as the local backups. A second site of your own meets the requirement just as well. **Is a USB disk enough as the immutable copy?** Yes, as long as it is disconnected after the backup and stored safely – then no attacker can reach it. More convenient is WORM storage, which automatically locks backups against deletion until a fixed date. **Is the 3-2-1-1-0 rule a legal requirement?** No, it is a proven recommendation from practice. Laws such as NIS2 and the GDPR require working backup and recovery; the rule is a good way to achieve that. More on this in the article NIS2 and backup (https://aegisgrid.de/en/guides/nis2-backup/). ## 3-2-1-1-0 in one run In a pilot project we implement the rule with you on your own systems. Request a pilot project (https://aegisgrid.de/en/contact/?thema=pilot) --- Source: https://aegisgrid.de/en/guides/acronis-alternative/ Guide · Comparison # An Acronis alternative from the EU: a factual comparison In short: Acronis Cyber Protect combines backup with protection against malware and covers a very wide range of platforms, including VMware vSphere and Google Workspace. AegisGrid concentrates on backup itself: Windows and Linux computers, Hyper-V, Proxmox VE, Xen and Microsoft 365 with one tool from an EU provider, immutable on your own backup server too, with check restores and signed evidence. By Uwe J. Solleder (https://aegisgrid.de/en/about-us/#uwe-solleder), Managing Director of MSD Computersysteme GmbH · Published on 2026-11-07 ## The main differences The information on Acronis comes from publicly available manufacturer information (sources below), as of November 2026. Features may differ depending on edition and version. | Feature | AegisGrid | Acronis Cyber Protect | | Provider / headquarters | MSD Computersysteme GmbH, Germany | Acronis International GmbH, Schaffhausen, Switzerland | | Focus | Backup, restore and verification | Backup together with protection against malware, EDR depending on edition | | Whole virtual machines | Hyper-V, Proxmox VE (LVM, LVM-thin, ZFS, Ceph RBD, qcow2), Xen | including VMware vSphere, Hyper-V, Proxmox VE, others depending on edition | | Microsoft 365 | In the same tool (Exchange Online, OneDrive, SharePoint), restore as an export | In the Backup Advanced edition or as a per-user add-on licence, Teams included; restore into the tenant | | Immutable backups | WORM with retention lock on your own backup server | Immutable Storage in the Acronis Cloud, on premises with Acronis Cyber Infrastructure | | Resuming after an interruption | Automatic, even after standby or shutdown; only the rest is transferred | n/a | | Scanning backups for malware | Virus scan with ClamAV on the backup server, with the first affected and last clean backup | In the Advanced edition | | Evidence | Chained, signed log, monthly report as PDF, copy via syslog | Acronis Notary (proof of authenticity for files), in the Advanced and Backup Advanced editions | | Cloud storage in Germany | Optional, in certified data centres in Germany | Data centres including Frankfurt am Main and Berlin | n/a = no clearly documented vendor information found. The comparison with other solutions such as Veeam, Proxmox Backup Server, restic and BorgBackup can be found on the Comparison (https://aegisgrid.de/en/comparison/) page. ## When AegisGrid is a good fit - **A provider in Germany matters to you:** software, support and, if you wish, Managed Backup (https://aegisgrid.de/en/managed-backup/) and cloud storage (https://aegisgrid.de/en/cloud-storage/) come from the EU, with a data processing agreement. - **Immutable without the cloud:** WORM with retention lock runs on your own backup server (https://aegisgrid.de/en/backup-server/), at a second site too – no separate storage platform is needed for it. - **Mixed environments without VMware:** Hyper-V, Proxmox VE and Xen, Windows and Linux servers and Microsoft 365 with one method and into the same stores, deduplicated across everything. - **Check instead of hope:** the backup server restores backups on a trial basis, starts VMs in an isolated environment and scans for viruses – see Testing restores (https://aegisgrid.de/en/guides/testing-restores/). - **Evidence for NIS2 and the BSI:** a chained, signed evidence log (https://aegisgrid.de/en/evidence/) with a monthly report and SIEM connection. - **Laptops and slow connections:** interrupted backups always continue where they left off. - **Your existing antivirus stays:** you already have endpoint protection and are looking for a backup that concentrates on backup. ## When Acronis may be the better choice - **VMware vSphere** is in use – AegisGrid does not back up vSphere. - **Backup and endpoint protection from one product** are wanted, with one console for both. - **Restoring Microsoft 365 directly into the tenant** or backing up Teams and Google Workspace – AegisGrid currently restores Microsoft 365 as an export and backs up neither Teams nor Google Workspace. - **Hyper-V failover clusters with CSV** – AegisGrid currently supports single Hyper-V hosts. - Your team is well versed in Acronis, and there is no reason to switch. ## Planning the switch A switch does not have to happen on a fixed date. A proven approach is to run AegisGrid in parallel for selected systems first, practise restores and let the old backups expire with their retention period. You can keep using the Acronis malware protection or replace it with another endpoint protection – that is a separate decision. In a pilot project (https://aegisgrid.de/en/contact/?thema=pilot) we check in advance whether all your systems are covered. ## Sources - Acronis: Company (https://www.acronis.com/en/company/), Editions and licences (https://www.acronis.com/en-us/products/cyber-protect/purchasing/), Immutable Storage (https://www.acronis.com/en/support/documentation/AcronisCyberProtect_16/immutable-storage.html), Microsoft 365 Backup (https://www.acronis.com/en/products/cloud/cyber-protect/m365-backup/), Proxmox VE (https://www.acronis.com/en/blog/posts/from-diy-scripts-to-zero-overhead-protection-acronis-introduces-agentless-proxmox-ve-backup/), Data centres (https://www.acronis.com/en-us/cloud/data-centers/), Berlin data centre (https://www.acronis.com/en/pr/2024/acronis-launches-new-cyber-cloud-data-center-in-berlin/) Acronis, Acronis Cyber Protect, VMware, vSphere, Hyper-V, Microsoft 365, Google Workspace and other product names mentioned are trademarks or registered trademarks of their respective owners. They are mentioned solely for the purpose of a factual comparison; there is no business relationship. We welcome any notes on outdated information. ## Frequently asked questions about switching from Acronis **Can AegisGrid read Acronis backups?** No. Existing Acronis backups remain readable with Acronis until they expire at the end of their retention period. New backups are made with AegisGrid. **Do I need different antivirus protection after switching?** If you have obtained your malware protection through Acronis so far, yes: AegisGrid is a backup solution and does not replace endpoint protection. It does, however, scan the backups themselves for viruses and, for file backups, warns of conspicuous changes such as those caused by ransomware. **Can I test AegisGrid alongside Acronis?** Yes. Both can run side by side as long as the backup windows do not interfere. Schedule them so that they do not both back up the same VM at the same time. ## Is AegisGrid right for your environment? In a pilot project we check this on your own systems – before you decide. Request a pilot project (https://aegisgrid.de/en/contact/?thema=pilot) --- Source: https://aegisgrid.de/en/guides/backup-plan/ Guide · Backup strategy # Writing a backup plan: what belongs in it In short: a backup plan sets down in writing what is backed up, how often, where to and for how long – and who does what in an emergency. It turns individual backup jobs into a strategy that can be checked: by your own IT, by auditors and by your cyber insurer. By Uwe J. Solleder (https://aegisgrid.de/en/about-us/#uwe-solleder), Managing Director of MSD Computersysteme GmbH · Published on 2026-10-30 · updated on 2026-11-01 ## Why a backup plan? Without a plan, backup grows along with the IT: a job here for the new server, a USB disk there for accounting. Whether everything is covered and whether a restore succeeds in the time needed, nobody then knows for sure. The plan forces you to answer these questions completely once and records the answers so that they do not depend on a single person. It is also expected from outside. The GDPR requires in Art. 32 the ability to restore personal data promptly after an incident and regular testing of the measures (Backup under the GDPR (https://aegisgrid.de/en/guides/gdpr-backup/)). NIS2 explicitly lists backup management among the obligations of the entities concerned (NIS2 and backup (https://aegisgrid.de/en/guides/nis2-backup/)). In the IT-Grundschutz of Germany's Federal Office for Information Security (BSI), the topic has a module of its own, CON.3 “Backup Concept”. And cyber insurers usually ask how backups are made before the policy is even signed. ## The nine building blocks A complete plan answers nine questions. For a small business, a few pages are often enough. | Building block | Key question | Result | | Inventory | Which systems, data and cloud services exist, and where are they? | List of all systems with data volume and owner | | Recovery objectives | How much data loss and how much downtime is acceptable for each system? | RPO and RTO per class of system | | Method | Whole drives, individual files or the virtual machine as a whole? How do databases stay consistent? | Backup type and schedule per system | | Storage locations | How many copies, on which media, which off-site, which immutable? | Destinations following the 3-2-1 rule | | Retention | How long are daily, weekly and monthly versions kept? | Generation scheme and deletion rules | | Protection | Who may read, change and delete backups? Where is the key? | Permissions, encryption, safekeeping of the key | | Responsibilities | Who reads the alerts, who stands in, who decides in an emergency? | Roles, deputies, order of recovery | | Tests | How often and how thoroughly is the restore rehearsed? | Test plan with documented results | | Evidence and upkeep | How is it proven what happened, and when is the plan reviewed? | Logs, reports, a fixed review date | ## RPO and RTO: the two most important figures The **recovery point objective (RPO)** states how much work may be lost at most – with a daily backup at 3 a.m. it is up to one day. The **recovery time objective (RTO)** states how long a system may be down at most before it is working again. Neither figure is set by IT alone, but by management together with the departments: what does a day without the ERP system cost, what does a lost morning in accounting cost? | Class of system | Examples | RPO | RTO | | Critical | Merchandise management, ERP, databases | a few hours | less than a day | | Important | File server, mail | one day | one to two days | | Supporting | Laptops, test systems | one day to one week | several days | The values are examples. What matters is that they are set deliberately and confirmed by tests: an RTO of four hours is worthless if restoring the database server takes six hours in the test. ## Storage locations and retention For storage locations, the 3-2-1 rule has proven itself and is also recommended by the BSI: three copies on two different media, one of them off-site. Against ransomware, an immutable or disconnected copy is added, plus regular tests – the 3-2-1-1-0 rule (https://aegisgrid.de/en/guides/3-2-1-1-0-rule/). Retention usually follows a generation scheme: daily versions for a few weeks, weekly ones for a few months, monthly ones for a year or longer. Many older versions help when an attack or an error is only noticed late. The GDPR sets an upper limit: backups containing personal data should not be kept longer than necessary and should then expire automatically. **A backup is not an archive:** statutory retention obligations under tax and commercial law – in Germany usually eight years for accounting vouchers and ten years for books and annual financial statements – are met by an audit-proof archive, not by the backup. Backups serve the restore and expire at the end of their period. ## Keys, permissions and responsibilities An encrypted backup is only as good as the safekeeping of its key. If the key exists only on the server that fails, the backup is lost along with it. The plan specifies where the key is kept – for example in a sealed emergency envelope in the safe and as a copy at a second location – and who has access to it. Permissions are just as important: the systems being backed up should not be able to delete their own backups, otherwise an attacker with their rights can do so too. And it must be clear who reads error alerts, who stands in during holidays and who decides in an emergency. The order of recovery – first the network and directory service, then databases, then the business applications – belongs in the emergency manual together with the contacts. ## Tests and evidence A plan that has never been rehearsed is an assumption. Regular restore tests (https://aegisgrid.de/en/guides/testing-restores/) confirm RPO and RTO and reveal gaps, such as a new drive that was never added to the backup. Every backup, every test and every deletion should be logged in a traceable way – that is the evidence for auditors, insurers and your own management. Review the plan at least once a year and after every major change: a new site, a new business application, moving services to the cloud or a change in the IT team. ## Checklist - All systems, data sets and cloud services such as Microsoft 365 are recorded, each with an owner. - RPO and RTO are set for each system together with management. - Backup type and schedule are set for each system, databases are backed up consistently. - There are at least three copies on two media, one off-site and one immutable or disconnected. - Retention is set by generations, expired backups are deleted automatically. - The backups are encrypted, the key is kept separately and is accessible in an emergency. - The systems being backed up cannot delete their backups. - Responsibility and deputies for alerts and emergencies are settled. - The order of recovery is in the emergency manual. - The restore is tested regularly, the results are documented. - The next review date for the plan is in the calendar. ## How AegisGrid puts the plan into practice With AegisGrid, the plan becomes configuration. One run writes to up to eight destinations – local disk, NAS, your own backup server (https://aegisgrid.de/en/backup-server/), a second site or the cloud storage (https://aegisgrid.de/en/cloud-storage/). Schedules take the public holidays of each German federal state into account and catch up on missed runs, and retention applies per destination, also by generations. The data is encrypted on the system being backed up, and the key stays with you. On WORM storage of the backup server, every backup is locked against changes and deletion until its lock expires, even for the computers being backed up. The backup server reports missing backups, regularly restores backups as a test and keeps a signed evidence log (https://aegisgrid.de/en/evidence/), from which an evidence report is produced as a PDF every month – proof that the plan is actually lived. If you would rather not run it yourself, leave the operation to our Managed Backup (https://aegisgrid.de/en/managed-backup/). ## Frequently asked questions about the backup plan **Is a backup plan mandatory?** For most companies there is no law that prescribes a document with this name. The GDPR does, however, require appropriate technical and organisational measures and their regular testing, and NIS2 requires backup management from the entities concerned. A written plan is the simplest way to demonstrate both. **How extensive does the plan have to be?** For a small business a few pages are often enough: the list of systems with RPO and RTO, the storage locations, retention, responsibilities and the test plan. More important than its length is that it is up to date and that someone other than its author can act on it in an emergency. **Is there a template?** Module CON.3 “Backup Concept” in the BSI's IT-Grundschutz Compendium describes what a plan should contain and works well as an outline. The nine building blocks and the checklist in this article cover the most important points. ## Go through your plan together We go through your backup plan with you and show how AegisGrid puts it into practice. Arrange a call (https://aegisgrid.de/en/contact/?thema=beratung) --- Source: https://aegisgrid.de/en/guides/file-server-backup/ Guide · Servers # Backing up a file server: data, permissions and fast restores In short: a file server is backed up from a snapshot so that open files are consistent with each other, and with all permissions so that the right people have access again after a restore. Incremental runs should only read what has changed. And since most requests concern individual files, what counts most is how quickly a file is back. By Uwe J. Solleder (https://aegisgrid.de/en/about-us/#uwe-solleder), Managing Director of MSD Computersysteme GmbH · Published on 2026-11-07 ## What is different about a file server - **Many people, many open files.** Work carries on during the backup. Without a snapshot, half-saved files end up in the backup. - **Permissions are part of the data.** Who may see which share and which folder is held in NTFS permissions or ACLs. If they are lost, the restore is only half done. - **Many files, little change.** Hundreds of thousands of files, of which only a small part changes each day. A good incremental backup recognises this without reading every file again. - **A popular target for ransomware.** An encrypted workstation also encrypts the shares through its network drives. ## Backing up consistently On Windows, the Volume Shadow Copy Service (VSS (https://aegisgrid.de/en/glossary/#shadow-copy)) provides a common point in time across all volumes involved – important when shares live on several volumes. On Linux, an LVM snapshot (https://aegisgrid.de/en/glossary/#snapshot) plays this role. If the server also runs an application with its own database, scripts before and after the snapshot briefly bring it into a safe state. ## What must be backed up as well | System | Besides the content | | Windows | NTFS permissions, owner, attributes, timestamps, alternate data streams | | Linux | Permissions, owner, timestamps, extended attributes with POSIX ACLs, symbolic and hard links | Whatever does not need backing up should be excluded: page and hibernation files, temporary folders, recycle bins. That saves space and time without anything missing when it matters. ## Spotting unusual changes early A file server normally changes at a steady pace. If suddenly ten times as many files change as usual, or typical ransomware extensions appear in large numbers, that is a warning sign. The backup sees it first – and should not only report it but also prevent the last good restore points from being cleaned up under the normal rule. More on this in the guide Ransomware and backup (https://aegisgrid.de/en/guides/ransomware-backup/). ## How AegisGrid backs up file servers AegisGrid backs up via VSS across all volumes involved on Windows and via an LVM snapshot (ext2/3/4, XFS) on Linux; without LVM it reads during operation and re-reads files that changed. Each profile allows up to 64 paths with exclusion patterns, and default exclusions are provided. Incremental runs take over unchanged files from the previous run; on Windows AegisGrid reads the changes from the USN journal. The data is deduplicated by content – also together with disk and VM backups in the same store – and encrypted before transfer. If a run stands out because of an unusual number of new, changed or deleted files, it is flagged, a notification goes out and older restore points stay protected for 30 days by default. Individual files are restored by searching across all restore points, see Restoring a deleted file (https://aegisgrid.de/en/guides/restore-deleted-file/). ## Frequently asked questions about file server backup **File backup or a backup of the whole disk?** For a file server usually both: the file backup for restoring individual files quickly and with permissions, a disk or VM backup to restore the whole server after a failure. Thanks to deduplication, the second backup takes up hardly any extra space. **How often should a file server be backed up?** That depends on how much work may be lost at most (RPO (https://aegisgrid.de/en/glossary/#rpo)). At least daily is common, several times a day where there is a lot of activity. Because incremental runs only read and store what has changed, even frequent runs are short. **Can I back up a NAS as a file server?** AegisGrid backs up the machines its agent runs on, that is Windows and Linux servers. With AegisGrid, a NAS serves as a destination for backups. If your shares are on a NAS, talk to us; in a pilot project we work out how best to cover your environment. ## Back up your file server In a pilot project we review shares, permissions and retention with you. Request a pilot project (https://aegisgrid.de/en/contact/?thema=pilot) --- Source: https://aegisgrid.de/en/guides/gdpr-backup/ Guide · Data protection # Backup under the GDPR: what you need to consider In short: the GDPR actually requires backups – Art. 32 demands the ability to restore personal data promptly after an incident. At the same time, backups are themselves personal data: they must be protected, stored in a suitable place, covered by a contract and deleted according to fixed periods. By Uwe J. Solleder (https://aegisgrid.de/en/about-us/#uwe-solleder), Managing Director of MSD Computersysteme GmbH · Published on 2026-10-27 · updated on 2026-11-01 ## What Art. 32 GDPR requires Art. 32 obliges controllers to take technical and organisational measures that ensure a level of security appropriate to the risk. For backups, four points of paragraph 1 are decisive: | Requirement | What it means for backups | | Point (a) – encryption | Encrypt backups, ideally before they leave the system being backed up | | Point (b) – confidentiality, integrity, availability, resilience | Copies in several places, protection against tampering, access only for authorised persons | | Point (c) – timely restoration | Restoring must be possible and feasible within a reasonable time | | Point (d) – regular testing | Check that the measures are effective – for backups: test the restore | ## Where backups may be stored The GDPR does not prohibit the cloud or service providers. It does, however, require transfers to countries outside the EU and the EEA to be specially safeguarded (Chapter V). The simplest option is a storage location in Germany or the EU with a provider subject to European law. If the backups are encrypted and the key stays with the company, not even a storage provider can learn anything about their content. ## Data processing on behalf of the controller If a service provider runs the backup or stores the backups, it is usually a processor under Art. 28 GDPR. A data processing agreement (DPA) is then required, covering the subject matter, duration, type of data, the technical and organisational measures and how sub-processors are handled. ## Deletion and storage limitation Under the principle of storage limitation (Art. 5(1)(e)), data may not be kept longer than necessary. For backups this means setting **fixed retention periods** and deleting backups automatically once they have passed. Removing individual records from a backup is usually not technically sensible and would damage the backup. Common practice is therefore: - backups expire in full at the end of their retention period; - until then they are protected against access and not used for other purposes; - if a backup is restored, previously deleted data is deleted again – for this purpose a record is kept of which deletions need to be repeated. The details belong in the deletion and backup plan and should be agreed with the data protection officer. ## Documenting Under the accountability principle (Art. 5(2)), a company must be able to demonstrate that it complies with the principles. For backups this means a written plan (https://aegisgrid.de/en/guides/backup-plan/), a record of backups and deletions and documented restore tests. ## How AegisGrid helps AegisGrid encrypts with AES-256-GCM or ChaCha20-Poly1305 on the system being backed up; the key stays with you. You decide where the backups are kept – on your own premises, at a second site or in the AegisGrid cloud storage (https://aegisgrid.de/en/cloud-storage/) in certified data centres in Germany. For cloud storage and Managed Backup, MSD Computersysteme GmbH concludes a data processing agreement under Art. 28 GDPR. Retention periods apply per backup and destination, the backup server cleans up expired backups automatically, and every deletion is recorded in the signed evidence log (https://aegisgrid.de/en/evidence/). This article is a general introduction and not legal advice. Agree your plan with your data protection officer. ## Frequently asked questions about the GDPR and backup **Do I have to change the backups when someone asks for their data to be deleted?** In practice, backups are usually not edited individually but expire at the end of their retention period. Until then they are protected and not used for anything else; if a backup is restored, the deletions are repeated. You should define the details with your data protection officer. **May I store backups in the cloud?** Yes, with a data processing agreement and suitable safeguards for the storage location. The simplest option is a provider with data centres in Germany or the EU, and with encryption before transfer the content stays unreadable even for the provider. **How long should I keep backups?** As long as you need them for restoring, and no longer. Common practice is daily versions for a few weeks and monthly or yearly versions for a longer period. Statutory retention obligations, for example for accounting records, are better met with archiving than with backups. ## Set up backups in line with data protection We advise you on storage location, retention periods and the data processing agreement. Arrange a call (https://aegisgrid.de/en/contact/?thema=beratung) --- Source: https://aegisgrid.de/en/guides/hyper-v-backup/ Guide · Virtualisation # Backing up Hyper-V: application-consistent and complete In short: a good Hyper-V backup is based on a recovery checkpoint that is application-consistent through VSS in the guest, reads only changed areas after the first backup and captures the configuration and vTPM state along with the disks. Without the certificates of the key protector, a VM with a vTPM cannot be opened on another host – something to think about before an emergency. By Uwe J. Solleder (https://aegisgrid.de/en/about-us/#uwe-solleder), Managing Director of MSD Computersysteme GmbH · Published on 2026-10-27 · updated on 2026-11-13 ## Not all checkpoints are the same Hyper-V has standard and production checkpoints for administrators and **recovery checkpoints** for backup programs. A recovery checkpoint freezes the state of all virtual hard disks at one point in time while the VM keeps running. If the backup integration service is active in the guest, Hyper-V uses the Volume Shadow Copy Service (VSS) in the guest to make sure that applications such as Exchange, SQL Server or Active Directory write their data cleanly to disk first. The result is **application-consistent**. Without the integration service, the backup is only **crash-consistent** – as if the VM had been switched off at that moment. The backup program should state this openly in its log. ## Only read what has changed With **Resilient Change Tracking** (RCT), Hyper-V keeps track of which areas of a virtual hard disk have changed since the last reference point. After the first full backup, only a fraction then needs to be read. Everything is read again if the basis has changed – for example after enlarging a disk, after a migration or a storage move. ## What a complete backup includes | Component | Purpose | | All virtual hard disks (VHDX) | The data, captured at the same point in time | | Configuration (.vmcx) | Processors, memory, network adapters, generation, firmware | | Guest state (.vmgs) | UEFI variables and the state of the virtual TPM | | Runtime state (.vmrs) | State file of the checkpoint | | Guardian certificates (optional) | So that the vTPM state can be opened on a new host | ## The vTPM pitfall Windows 11 and Windows Server with BitLocker often use a virtual TPM. Its state is encrypted with the certificates of the host's local key protector (“Shielded VM Local Certificates”). If the VM is restored on a new host that lacks these certificates, it does not start or asks for the BitLocker recovery key. That is why the certificates – with their private key and only in encrypted form – belong in the emergency planning. ## Restoring without disrupting operations - **As a new VM** with a new ID and its own name, switched off – so it cannot collide with the original. - **Adjusting the network:** assign virtual switches, and only take over static MAC addresses if the original is definitely off. - **Single files** taken straight from the backup without restoring the disk, or individual disks restored as VHDX. ## How AegisGrid backs up Hyper-V AegisGrid backs up a VM on the host as a whole: all virtual hard disks, configuration and state files including the vTPM, based on a recovery checkpoint and application-consistent through VSS in the guest by default. Thanks to RCT, subsequent backups read only changed areas. If you wish, AegisGrid includes the Guardian certificates – only in encrypted destinations – and before a restore checks whether the target host can open the VM before it creates anything. Restores are made as a new VM or disk by disk. AegisGrid currently supports single Hyper-V hosts; failover clusters with CSV, pass-through disks, shared VHDX and shielded VMs are not yet supported. ## Frequently asked questions about Hyper-V backup **Does an agent have to be installed in the guest?** No. For an application-consistent backup, the Hyper-V integration services in the guest are enough; current Windows versions already include them. The backup is made on the host. **Does the VM slow down during the backup?** The VM keeps running. While the checkpoint is being created, VSS in the guest briefly prepares the applications; afterwards data is read from the checkpoint, not from the running disk. **Can I get individual files from a VM backup?** Yes, without restoring the disk first. In the management console, choose a volume of the VM under “Restore files” and tick the files and folders you need, or open the volumes of a run as read-only folders. Windows reads NTFS, ReFS, FAT and exFAT. Alternatively, restore a single virtual hard disk as VHDX and mount it. ## Back up your Hyper-V environment In a pilot project we back up your VMs and restore them as a test. Request a pilot project (https://aegisgrid.de/en/contact/?thema=pilot) --- Source: https://aegisgrid.de/en/guides/laptop-backup/ Guide · Mobile workplaces # Backing up field staff laptops reliably In short: laptops are rarely in the office long enough for a complete backup. It only becomes reliable when the backup runs in the background over any internet connection, survives interruptions without loss, transfers only what is missing and needs nobody to take part. By Uwe J. Solleder (https://aegisgrid.de/en/about-us/#uwe-solleder), Managing Director of MSD Computersysteme GmbH · Published on 2026-10-27 · updated on 2026-11-01 ## Why laptops are so often not backed up - **Rarely on the company network:** the backup is designed for the office, but the laptop is at a customer's, on the train or in the home office. - **Lid closed in the middle of the backup:** many solutions then start again from the beginning – and with large amounts of data never finish. - **Slow connections:** hotel Wi-Fi and mobile networks are not enough for a first backup of a hundred gigabytes in one go. - **User involvement needed:** if users have to start a backup or wait for it, it does not happen. - **Local data:** quotes, calculations and presentations of all things are often stored only on the device. ## How to recognise a good laptop backup | Requirement | Why | | Runs over the internet | The destination can be reached from anywhere, encrypted via TLS | | Resumes after interruptions | Standby, shutting down, a flat battery or a dropped connection cost no work already done | | Transfers only what is missing | Deduplication and resuming save time and data volume | | Runs in the background | On a schedule, without anyone having to start anything | | Can be throttled | Limit bandwidth or pause when the connection is needed | | Encrypts before transfer | A lost laptop is bad enough – the backup must not give anything away | | Reports when something is missing | IT sees which device has not been backed up for days | ## Planning the first backup The first backup transfers everything and takes correspondingly long. It is easiest in the office over the fast network. If it has to happen on the road, what matters is that it arrives in several stages – two hours in the hotel today, one on the train tomorrow – instead of starting over each time. After that the daily backups are small, because only changes are transferred. ## How AegisGrid backs up laptops AegisGrid backs up Windows 10 and Windows 11 laptops on a schedule in the background to a backup server or the cloud storage (https://aegisgrid.de/en/cloud-storage/), encrypted before transfer. Resuming is always on: after standby or a dropped connection, AegisGrid continues the same backup; after shutting down or a flat battery, it picks it up again at the next start, and only what is still missing is transferred. A backup only counts as finished when it is complete. Running backups can be paused or limited in bandwidth. If a device stays away, the backup server reports this to the responsible contacts. More on this on the page Laptops and mobile workplaces (https://aegisgrid.de/en/solutions/notebooks/). ## Frequently asked questions about laptop backup **Is OneDrive enough as a backup for laptops?** OneDrive synchronises selected folders but does not back up the whole device, and deletions or encryptions are synchronised as well. How long Microsoft keeps deleted items is explained in the article Backing up Microsoft 365 (https://aegisgrid.de/en/guides/microsoft-365-backup/). **Does the user notice the backup?** The backup runs in the background. If you wish, a small window shows the progress; bandwidth can be limited so that video conferences and downloads do not suffer. **What happens if a laptop is stolen?** The data is preserved on the backup server and can be restored to a new device. Because the backup is encrypted, it gives a thief nothing; the device itself should additionally be encrypted with BitLocker. ## Back up laptops on the road In a pilot project we back up your field staff's laptops – even over slow connections. Request a pilot project (https://aegisgrid.de/en/contact/?thema=pilot) --- Source: https://aegisgrid.de/en/guides/microsoft-365-backup/ Guide · Microsoft 365 # Backing up Microsoft 365: why the recycle bin is not a backup In short: Microsoft makes sure that Exchange Online, OneDrive and SharePoint keep running. For your data – deleted by mistake, encrypted by ransomware or gone with a departed employee – you are responsible yourself. The recycle bin and retention periods only help for a short time and not in every case. By Uwe J. Solleder (https://aegisgrid.de/en/about-us/#uwe-solleder), Managing Director of MSD Computersysteme GmbH · Published on 2026-10-27 · updated on 2026-11-01 ## Shared responsibility Cloud services follow the shared responsibility model: the provider is responsible for data centres, hardware and the availability of the service. What happens to the content – who deletes, overwrites or encrypts it – is up to the customer. Microsoft does replicate your data across several data centres, but every deletion and every encryption is replicated just as reliably. ## How long Microsoft 365 keeps deleted items Without additional retention policies, these default values apply: | Service | What happens after deletion | Afterwards | | Exchange Online | Permanently deleted items stay in the “Recoverable Items” folder – 14 days by default, 30 days at most | Gone for good | | OneDrive and SharePoint | Recycle bin and second-stage recycle bin, 93 days in total | Gone for good | | OneDrive of departed employees | Kept for 30 days by default after the account is deleted (configurable) | Gone for good | Retention policies and archiving in Microsoft 365 can extend these periods. They are not a backup in the true sense, though: they live in the same tenant, with the same administrator accounts – whoever takes over these accounts can also change the policies. ## Five cases in which only a backup helps - **Deleted and noticed too late:** a folder of project documents has been missing for four months – the recycle bin was emptied long ago. - **Ransomware via synchronisation:** an infected laptop encrypts local files, and OneDrive synchronises the encrypted versions to the cloud. - **Departed employees:** the account and licence are removed; weeks later, mail or files are needed for a legal dispute. - **Compromised administrator account:** an attacker deliberately deletes mailboxes and sites. - **Audit and evidence:** for retention obligations or an audit, the state of a particular day has to be produced. ## What matters in a Microsoft 365 backup - **Complete:** mail from all folders, calendars, contacts, tasks, OneDrive and SharePoint – not just the mailboxes. - **Outside the tenant:** the backup is kept in a place that an attacker with Microsoft credentials cannot reach. - **Encrypted and in Germany:** for the GDPR, what counts is the location, the data processing agreement and who holds the key. - **With minimal permissions:** a dedicated app registration in Entra ID with read permissions, restricted to the necessary mailboxes and sites where possible. - **Many versions:** each day can be retrieved individually, even after months. ## How AegisGrid backs up Microsoft 365 AegisGrid backs up via Microsoft Graph with a dedicated app registration: Exchange mailboxes with all folders, calendars with attachments, contacts, tasks, OneDrive and SharePoint document libraries – for individual accounts or the whole tenant. Every run is a complete version, but only what has changed is transferred. The data is encrypted before it is stored and can go to up to eight destinations, for example to your own backup server and to the cloud storage (https://aegisgrid.de/en/cloud-storage/) in Germany. Restores are currently made as an export: mail as .eml files, files as a folder tree with their modification time, appointments, contacts and tasks as files – filtered by account, folder and period. Restoring directly into the tenant is not yet available. ## Frequently asked questions about Microsoft 365 backup **Doesn't Microsoft back up my data itself?** Microsoft protects the service against failures of its data centres. That does not help against deletions, encryption by ransomware or compromised accounts, because these changes are replicated just the same. Microsoft keeps deleted content only for a limited time. **Is a GDPR-compliant backup of Microsoft 365 possible?** Yes. What matters is a storage location that you decide on, encryption with a key in your hands and a data processing agreement with every service provider that runs or stores the backup. **Which permissions does the backup need?** Only read permissions via Microsoft Graph for the areas being backed up – such as mail, calendars, contacts, tasks and files. Exchange Online and SharePoint can additionally be restricted to individual mailboxes and sites. ## Back up Microsoft 365 in Germany In a pilot project we set up the backup of your tenant with you. Request a pilot project (https://aegisgrid.de/en/contact/?thema=pilot) --- Source: https://aegisgrid.de/en/guides/nis2-backup/ Guide · Law and obligations # NIS2 and backup: what companies have to prove In short: NIS2 explicitly names backup management and recovery after an emergency as a minimum measure. Having backups is not enough – a company must be able to show that they run regularly, are protected and can be restored. Management is responsible for this. By Uwe J. Solleder (https://aegisgrid.de/en/about-us/#uwe-solleder), Managing Director of MSD Computersysteme GmbH · Published on 2026-10-27 · updated on 2026-11-01 ## What NIS2 says about backup The NIS2 Directive (EU) 2022/2555 obliges companies in important sectors to take measures for their cybersecurity. Article 21(2) lists the minimum measures. Point (c) covers **business continuity, such as backup management and disaster recovery, and crisis management**. Two further points of the same list concern backup directly: point (f) requires policies and procedures to **assess the effectiveness of the measures** – for backups this means testing the restore. Point (h) requires the use of **cryptography and encryption** where appropriate. Article 20 places responsibility with the management: the management bodies must approve the measures, oversee their implementation and receive training on them. Backup is thus explicitly a matter for the top. ## Who is affected NIS2 applies to companies in the sectors listed in Annexes I and II of the Directive – for example energy, transport, health, digital infrastructure, IT services for other companies (managed services), waste, chemicals, food, manufacturing of critical products and digital services. As a rule, medium-sized and large companies in these sectors are affected, that is, those with 50 or more employees or an annual turnover and balance sheet total of more than 10 million euros. For some areas, NIS2 applies regardless of size. In Germany, the NIS2 Implementation Act transposes the Directive into the BSI Act. Entities concerned must register with the BSI, Germany's Federal Office for Information Security. Whether and how your company is covered should be checked case by case; the BSI offers an online check for this. In other EU countries, the national transposition law and the competent authority there apply. **Even without NIS2:** the GDPR already requires in Art. 32 the ability to restore personal data promptly after an incident and regular testing of the measures. Many cyber insurance policies ask the same questions. ## What auditors want to see in backups Laws name objectives, not products. In practice, however, audits come down to the same questions: | Auditor's question | What serves as evidence | | Is there a backup plan? | A written plan: what, how often, where to, how long it is kept, who is responsible (BSI IT-Grundschutz CON.3) | | Do the backups really run? | A record of all backups with their result, complete over the audit period | | Are they protected against attacks? | An immutable or disconnected copy, encryption, an off-site copy | | Can they be restored? | Documented restore tests with date, scope and result | | Who deleted or changed what? | A traceable record of deletions and changes to retention | | Can the log be trusted? | Tamper-proof logging, a copy at a second location (BSI IT-Grundschutz OPS.1.1.5) | ## Five steps to backups you can prove - **Write a plan:** define the systems, data volumes, backup frequency, retention and the maximum tolerable downtime for each system. What belongs in it is shown in the guide Backup plan (https://aegisgrid.de/en/guides/backup-plan/). - **Several copies in several places:** at least one copy off-site and one immutable – the 3-2-1-1-0 rule (https://aegisgrid.de/en/guides/3-2-1-1-0-rule/) is a good guideline for this. - **Test the restore regularly** – not just once a year by hand, but continuously and documented. How to do this automatically is shown in the article Testing restores (https://aegisgrid.de/en/guides/testing-restores/). - **Log everything** that happens to the backups, and protect the log against later changes. - **Report:** management regularly receives an understandable report and can thus prove that it fulfils its oversight duty. ## What happens if it is missing The Directive provides for substantial fines: for essential entities up to 10 million euros or 2% of worldwide annual turnover, for important entities up to 7 million euros or 1.4% – whichever is higher. Often the damage itself weighs more heavily: without a working restore, a company stands still for days or weeks after a ransomware attack. ## How AegisGrid helps AegisGrid writes to up to eight destinations in one run, including immutable and off-site ones. The backup server (https://aegisgrid.de/en/backup-server/) automatically restores backups as a test and starts virtual machines in an isolated sandbox. Every backup, restore, check and deletion is recorded in a chained, daily signed evidence log (https://aegisgrid.de/en/evidence/), which can be sent to your SIEM immediately if you wish. Every month it produces a signed evidence report as a PDF – for auditors and for management. This article is a general introduction and not legal advice. No software on its own makes a company NIS2-compliant; backup is one building block of an overall concept. ## Frequently asked questions about NIS2 and backup **Does NIS2 require a particular backup software?** No. NIS2 prescribes objectives, not products: backup management, recovery after an emergency, assessing effectiveness and encryption where appropriate. What matters is that you can prove the implementation. **How often do you have to test the restore?** NIS2 does not set a fixed interval. Regular spot checks, for example weekly, and a full test of the most important systems at least once a year have proven themselves. What matters is that every test is documented with its result. **Does NIS2 also apply to IT service providers?** Yes, managed service providers are among the sectors of the Directive. In addition, their customers increasingly demand evidence of supply chain security. ## Make your backups provable We show you the log and the evidence report on your own systems. Arrange a call (https://aegisgrid.de/en/contact/?thema=beratung) --- Source: https://aegisgrid.de/en/guides/proxmox-backup-server-or-aegisgrid/ Guide · Comparison # Proxmox Backup Server or AegisGrid? An honest comparison In short: for a pure Proxmox environment, Proxmox Backup Server is an obvious open-source choice – deeply integrated, with live restore and containers. AegisGrid fits when Windows computers, Hyper-V, Xen or Microsoft 365 are to be backed up alongside Proxmox VE, with one method, immutable storage with retention lock, check restores and signed evidence. The two can also be run side by side. By Uwe J. Solleder (https://aegisgrid.de/en/about-us/#uwe-solleder), Managing Director of MSD Computersysteme GmbH · Published on 2026-11-07 · updated on 2026-11-13 ## The main differences The information on Proxmox Backup Server (PBS) comes from the manufacturer's documentation (sources below), as of November 2026, version 4.2. | Feature | AegisGrid | Proxmox Backup Server | | Provider / headquarters | MSD Computersysteme GmbH, Germany | Proxmox Server Solutions GmbH, Vienna, Austria | | Licence | Commercial | Open source (AGPLv3), support subscriptions | | Proxmox VMs | Whole VMs with all disks, EFI disk, vTPM and configuration; LVM, LVM-thin, ZFS, Ceph RBD, qcow2; restore in place as well | Whole VMs, integrated into the Proxmox VE interface | | Fast follow-up backups of running VMs | Yes, through QEMU dirty bitmaps; read in full once after a restart of the VM | Yes, through QEMU dirty bitmaps | | Proxmox containers (LXC) | No | Yes | | Other platforms | Windows and Linux with VSS or LVM snapshot, Hyper-V, Xen, Microsoft 365 | Linux computers via the command-line client; no Windows client from Proxmox | | Starting a VM before the restore has finished | No; restore parallelised and in the background | Yes (live restore) | | Single files from VM backups | Yes, on Windows and Linux: provide a disk read-only and fetch files without restoring it | Yes, in the Proxmox VE interface | | Immutable backups | WORM with retention lock | Protection flag for individual backups; tapes as WORM | | Verification | Check of all objects, repair from a second copy, check restore with VM start, virus scan | Verify jobs over the checksums of all chunks | | Further copies | Up to eight targets in one run, including S3-compatible object storage; mirroring to a second site, export for tape or USB disk | Sync to a second PBS, tape libraries, S3-compatible object storage, removable datastores | | Evidence | Chained, signed log, monthly report as PDF, copy via syslog | n/a | n/a = no clearly documented vendor information found. Both have in common: deduplication across all backups of a store, encryption before transfer with AES-256-GCM (AegisGrid optionally ChaCha20-Poly1305), compression with zstd and a web interface or console for management. Further solutions are compared on the Comparison (https://aegisgrid.de/en/comparison/) page. ## When Proxmox Backup Server is the better choice - **A pure Proxmox environment** without Windows computers outside VMs, without Hyper-V and without Microsoft 365. - **Containers (LXC)** are to be backed up – AegisGrid currently backs up VMs only. - **Live restore** matters: the VM should start while the data is still coming back. - **Tape libraries** are to be driven directly. - **Open source without licence costs** is a requirement, and the team runs the server itself. - **Disks on iSCSI** or large raw and vmdk files are in use – AegisGrid rejects such VMs instead of backing them up incompletely. ## When AegisGrid is a good fit - **Mixed environments:** Proxmox VE alongside Windows servers and workstations, Hyper-V, Xen and Microsoft 365 – with one method and into the same stores, deduplicated across everything. - **Immutable with a deadline:** WORM with retention lock on your own backup server (https://aegisgrid.de/en/backup-server/): until the period expires, a backup cannot be deleted via AegisGrid; the lock of individual backups can be extended selectively. - **Check instead of hope:** the backup server starts backed-up VMs on a trial basis in an isolated environment, checks file systems and scans for viruses – see Testing restores (https://aegisgrid.de/en/guides/testing-restores/). - **Evidence for NIS2 and the BSI:** a chained, signed evidence log (https://aegisgrid.de/en/evidence/) with a monthly report and SIEM connection. - **Several targets in one run:** local, NAS, your own backup server at a second site and cloud storage at the same time. - **Support from a single source:** if you wish, Managed Backup (https://aegisgrid.de/en/managed-backup/) with a personal contact in Germany. ## Both together The two tools are not mutually exclusive. Some environments back up containers with Proxmox Backup Server and VMs, Windows computers and Microsoft 365 with AegisGrid. The only important thing is that both do not back up the same VM at the same time – both work with snapshots of the same disks. How AegisGrid backs up Proxmox VMs in detail is described in the guide Backing up Proxmox VE (https://aegisgrid.de/en/guides/proxmox-ve-backup/). ## Sources - Proxmox: Proxmox Backup Server – introduction (https://pbs.proxmox.com/docs/introduction.html), Datastores (https://pbs.proxmox.com/docs/storage.html), Technical overview (https://pbs.proxmox.com/docs/technical-overview.html), Roadmap and release notes (https://pbs.proxmox.com/wiki/Roadmap), Proxmox VE – backup and restore (https://pve.proxmox.com/pve-docs/chapter-vzdump.html), Legal notice (https://proxmox.com/de/impressum) Proxmox, Proxmox VE, Proxmox Backup Server, Hyper-V, Microsoft 365 and other product names mentioned are trademarks or registered trademarks of their respective owners. They are mentioned solely for the purpose of a factual comparison; there is no business relationship. We welcome any notes on outdated information. ## Frequently asked questions **Can AegisGrid read Proxmox Backup Server backups?** No. Existing backups remain readable with Proxmox Backup Server until they expire at the end of their retention period. New backups are made with AegisGrid. **Does AegisGrid need the QEMU guest agent?** No, but it is recommended. With the guest agent, AegisGrid briefly freezes the file systems of all disks together; without it, it backs up crash-consistently and notes this in the log. **Can I restore a Proxmox VM on a different host?** Yes. The backup contains the configuration of the VM; it is restored as a new VM, optionally with a different VMID, different storage and new or the original MAC addresses. ## Is AegisGrid right for your Proxmox environment? In a pilot project we check in advance whether all your VMs and storage types are covered. Request a pilot project (https://aegisgrid.de/en/contact/?thema=pilot) --- Source: https://aegisgrid.de/en/guides/proxmox-ve-backup/ Guide · Virtualisation # Backing up Proxmox VE: VMs consistent, encrypted, off-site In short: always back up a Proxmox VM as a whole – all disks at the same point in time, plus configuration, UEFI variables and vTPM. With the QEMU guest agent the backup becomes file-system-consistent. And at least one copy belongs off-site, encrypted. By Uwe J. Solleder (https://aegisgrid.de/en/about-us/#uwe-solleder), Managing Director of MSD Computersysteme GmbH · Published on 2026-10-27 · updated on 2026-11-13 ## What belongs to a VM A VM consists of more than its system disk. A complete restore needs: - **all virtual disks**, captured at the same point in time – otherwise the database and log disks do not match; - the VM's **configuration**: processors, memory, network adapters, firmware; - for UEFI systems, the **EFI disk** with the UEFI variables; - for Windows 11 and BitLocker, the **vTPM state** – without it the system does not start or asks for the recovery key. ## Consistent rather than merely “crash-safe” If a running VM is backed up without preparation, the result is like a hard power-off: it usually starts, but open files and databases may be incomplete. With the **QEMU guest agent**, the file systems in the guest can be frozen briefly until the snapshots of all disks are in place. How long the guest was frozen should be stated in the backup log. For this, the package qemu-guest-agent (on Windows the VirtIO guest tools) must be installed in the VM and enabled in Proxmox under Options → QEMU Guest Agent. ## Storage types and snapshots | Storage | How the snapshot is created | | LVM, LVM-thin | LVM snapshot of the volume | | ZFS | ZFS snapshot of the zvol, read via a clone | | qcow2 file (directory, NFS, CIFS) | internal snapshot in the image; for a running VM via QEMU for all disks together | | Ceph RBD | RBD snapshot, read via the kernel client – also for external clusters | ## Don't forget the off-site copy A backup on storage in the same cluster protects against operating errors, but not against fire, ransomware or a compromised administrator account. Following the 3-2-1-1-0 rule (https://aegisgrid.de/en/guides/3-2-1-1-0-rule/), one copy belongs at another location and one locked as immutable – encrypted before it leaves the host. ## How AegisGrid backs up Proxmox VE AegisGrid runs directly on the Proxmox host and backs up a VM in one run with all disks, EFI disk, vTPM state and configuration – on LVM, LVM-thin, ZFS, Ceph RBD and qcow2. With the guest agent it freezes all disks together and keeps the window as short as possible; without the guest agent it backs up crash-consistently and notes this in the log. Thanks to change tracking (CBT), follow-up backups read only what the guest has written since the last backup. The data is deduplicated and encrypted and can go to up to eight destinations in one run. Restores are made as a new VM, disk by disk or in place over the existing VM, also directly from the backup server. The backup server (https://aegisgrid.de/en/backup-server/) can also regularly start the VMs as a test in an isolated environment. ## Frequently asked questions about Proxmox backup **Do I have to shut down the VM for the backup?** No. Running VMs are backed up via snapshots. With the QEMU guest agent, the file systems in the guest are frozen only briefly for this. **Does every backup have to read the whole VM?** No. After the first backup, QEMU keeps track of which areas the guest has written, and AegisGrid reads only those. The whole VM is read again after a restart or migration of the VM, after a disk has been enlarged and whenever there is any doubt – with a plain note in the log. **What happens to disks on iSCSI?** AegisGrid does not back up disks directly on iSCSI or larger raw and vmdk files. If a VM has such a disk, it is rejected with a clear message instead of being backed up incompletely; in Proxmox the disk can be moved to qcow2, ZFS or LVM-thin with “Move Storage”. **Can I restore a VM on a different host?** Yes. The backup contains the VM's configuration; it is restored as a new VM, if you wish with a different VMID, different storage and new or the original MAC addresses. **Can I reset a VM to an earlier version?** Yes, in place: the VM keeps its VMID. Its disks are first written next to the existing ones and switched over only after success; the previous ones are kept. If there is no room for a second copy, AegisGrid writes directly into the existing disks, optionally only the changed blocks. ## Back up your Proxmox environment In a pilot project we check in advance whether all your VMs and storage types are covered. Request a pilot project (https://aegisgrid.de/en/contact/?thema=pilot) --- Source: https://aegisgrid.de/en/guides/ransomware-backup/ Guide · Security # Ransomware: backups that survive an attack In short: modern attackers look for and destroy the backups first, before they encrypt. Only a backup that cannot be deleted from the company network – locked on a separate backup server, off-site or offline – and whose restore has been rehearsed beforehand will survive the attack. By Uwe J. Solleder (https://aegisgrid.de/en/about-us/#uwe-solleder), Managing Director of MSD Computersysteme GmbH · Published on 2026-10-27 · updated on 2026-11-07 ## How an attack on the backups unfolds - **Getting in:** via a phishing email, a vulnerability or stolen credentials. - **Spreading:** the attackers collect administrator rights, often unnoticed for weeks. - **Finding the backups:** backup servers, NAS shares, shadow copies and cloud accounts are searched for. - **Destroying the backups:** deleted or encrypted along with everything else, using the stolen rights. - **Encrypting and extorting:** only now does the attack become visible – usually at night or at the weekend. It follows that any backup an administrator of the company network can delete can also be deleted by an attacker with those rights. ## Five measures that really help | Measure | What it achieves | | Immutable copy | Backups are locked against changes and deletion until a set date – even for the computers being backed up and their credentials | | Separate backup server | Its own credentials, not a member of the Windows domain, only the necessary ports open | | Off-site copy | A second copy at another location, with different credentials | | Offline copy | A regular export to USB disk or tape, then kept disconnected from the network | | Rehearsed restore | Regular check restores show that the backups are clean and complete | ## Protecting the backup server itself A retention lock is only as strong as the server that enforces it. For the backup server this means: a separate operating system account for administration, no domain membership, no logins with the same passwords as in the rest of the network, timely updates, access only via the necessary interfaces. Anyone who also keeps an offline copy has a reserve even for the worst case. ## After the attack: restoring cleanly - **Choose the right version:** attackers are often in the network weeks before the encryption. Many retained versions make it possible to go back to a point in time before the intrusion. - **Check first, then restore:** start restored systems in isolation first and examine them, so that the malware does not come back with them. - **Know the order:** first the directory service and network, then the business applications – practised, not improvised. ## How AegisGrid protects against ransomware AegisGrid encrypts the data on the system being backed up and writes it to up to eight destinations in one run. On WORM storage of the backup server (https://aegisgrid.de/en/backup-server/), every backup is locked against changes and deletion until its lock expires: the backup server enforces the lock against all computers being backed up and all interfaces, and their access keys apply only to their own directories. On the server itself, data processing runs under a separate, unprivileged account. For the offline copy, AegisGrid exports individual backups as an archive to USB disk or tape. Check restores start restored VMs in an isolated environment without any outside connection and read every file in the backup: if seemingly encrypted files or ransom notes pile up, the backup server reports this while clean versions are still available. Every deletion is recorded in the signed evidence log (https://aegisgrid.de/en/evidence/). ## Frequently asked questions about backup and ransomware **Are shadow copies and a NAS enough against ransomware?** Usually not. Ransomware with administrator rights deletes shadow copies in seconds, and a NAS share that can be written to from the network is encrypted as well. What is needed is at least one copy that cannot be deleted with the rights available in the company network. **How long should the lock last?** Longer than an attack can remain unnoticed – in practice at least 14 to 30 days for the daily backup, plus older monthly versions with a longer lock. What matters is that several older versions are kept. **Does AegisGrid notice if ransomware is already in the backup?** The backup server's check restore reads every file of the restored backup and looks for signs of encryption: content that does not match its file extension or looks like random data, typical extensions of ransomware and ransom notes. If there are clearly more than at the last check, an alert is raised – so an attack is noticed before the last clean backup expires. For file backups, the agent itself checks every run: if unusually many files change or many typical extensions appear, the run is marked, a message goes out and the older versions are not cleaned up for a set period. If desired, the check restore also scans the backups for viruses with ClamAV and names the last backup without the finding. This does not replace antivirus protection on the systems. **Does encrypting the backup help against ransomware?** It protects confidentiality: stolen backups give nothing away. It does not protect against deletion or renewed encryption – that requires the immutable and the offline copy. ## Would your backup withstand an attack? We check with you whether your backups would survive an attack. Arrange a call (https://aegisgrid.de/en/contact/?thema=beratung) --- Source: https://aegisgrid.de/en/guides/restore-deleted-file/ Guide · Restore # Restoring a deleted file: finding the right restore point In short: when a file has been deleted or overwritten, stop changing anything in that folder and work out when it was last correct. Then search for the file across all restore points of the backup, pick the right version and, if in doubt, restore it to a different folder – that way nothing current is overwritten. By Uwe J. Solleder (https://aegisgrid.de/en/about-us/#uwe-solleder), Managing Director of MSD Computersysteme GmbH · Published on 2026-11-07 ## First: answer three questions - **When was the file last correct?** If you know it was still right on Tuesday, you search that period instead of every restore point. - **Deleted or overwritten?** A deleted file is missing from newer restore points altogether. An overwritten one is in every restore point – what you need is an older version. - **Where should it go?** To the original location if nothing is there any more. To a different folder if a newer file with the same name now exists or the versions need comparing first. The recycle bin and Windows shadow copies only help as long as the deletion is recent and nobody has cleaned up. A backup reaches further back – as far as its retention (https://aegisgrid.de/en/glossary/#retention) allows. ## Finding the right restore point Every backup captures a restore point (https://aegisgrid.de/en/glossary/#restore-point) of the data. With daily backups there is one per day, with several runs a day correspondingly more. Rather than opening one restore point after another, a search across all of them is faster: it shows which restore points contain a file and when it changed. | Situation | Which restore point fits | | File deleted by mistake | The last restore point that still contains the file | | File saved with wrong content | The last version before the change – size and modification time of the versions give the clue | | Folder reorganised or renamed | The restore point before the reorganisation, as a whole folder | (https://aegisgrid.de/en/guides/ransomware-backup/) | Files encrypted by ransomware | The last restore point before the attack – not simply the newest; see Ransomware and backup | ## Compare versions before anything is overwritten With overwritten files in particular, comparing two restore points pays off: what was added, removed or changed between Monday and Wednesday? If unsure, restore the older version to a folder of its own and compare it with the current one there. Only once it is clear which version is right does it go back in its place. ## Permissions and properties belong to the file A restored file should behave as before: with the same permissions, the same owner and the same timestamps. Without its NTFS permissions, a file on a file server may suddenly be open to everyone – or to no one. A file backup should therefore include these properties and set them again on restore. ## How this works with AegisGrid AegisGrid searches for a file by name across all restore points, optionally limited to a period, shows every version of a file and compares two restore points. Files are restored to the original location, to a different folder or as a ZIP archive. In the management console you select files and folders with checkboxes. If you prefer to browse, open a restore point as a read-only folder – on Windows and Linux; it disappears by itself after a while without access. On Linux, individual files can also be taken from disk and VM backups. Permissions, owner and times are backed up and restored, on Windows including NTFS permissions. ## Frequently asked questions about restoring files **How far back can I restore a file?** As far as the backup's retention reaches. A tiered scheme is common, for example daily restore points for two weeks, weekly ones for a few months and monthly ones for a year or longer. Older restore points are cleaned up according to this rule. **Will the current file be overwritten when restoring?** Only if you restore to the original location and a file with the same name is there. If in doubt, restore the file to a different folder or as a ZIP archive and compare first. **Do I have to restore an entire backup for this?** No. Individual files and folders are taken directly from the chosen restore point without touching the rest of the backup. Because every restore point is complete, no chain of full and incremental backups is needed either. ## Files back quickly instead of long searches In a pilot project we set up the file backup and practise restoring together with you. Request a pilot project (https://aegisgrid.de/en/contact/?thema=pilot) --- Source: https://aegisgrid.de/en/guides/scanning-backups-for-viruses/ Guide · Security # Scanning backups for viruses: restore clean, not reinfected In short: malware is often detected only weeks after the infection – and by then it has long been in the backups. Scanning backups regularly with current signatures tells you since when a finding has been in the backups and which backup is the last clean one. That way, a restore does not bring the malware back with it. By Uwe J. Solleder (https://aegisgrid.de/en/about-us/#uwe-solleder), Managing Director of MSD Computersysteme GmbH · Published on 2026-11-07 ## Why the virus scanner on the server is not enough Antivirus on servers and workstations checks with today's signatures. What was still unknown at the time of the backup three weeks ago may be detected today – but in the backup it stays unnoticed. At the latest when restoring after an attack this becomes a problem: if an infected restore point is restored, the attacker is straight back in the network. Scanning the backups does not replace antivirus on the systems. It adds a look back. ## Where and how to scan - **Not on the production system.** Scanning large amounts of data costs CPU time and disk access. It belongs on the backup server, which holds the backup anyway. - **Read-only.** The scan must not change the backup – not by “cleaning” and not by moving files to quarantine. A backup is a piece of evidence. - **With current signatures.** A backup server without internet access also needs fresh signatures, otherwise it scans with yesterday's knowledge. - **Regularly, not just once.** A new scan is worthwhile above all when new signatures are available. Unchanged files need not be read again every time, but now and then they should be. ## What a finding means | Question | Why it matters | | Which file, which signature? | Shows whether it is a single suspicious document or malware in the system | | Since which backup has it been there? | Narrows down when the infection happened – important for the investigation and for reporting obligations | | Which backup is the last one without it? | That is the restore point to restore from in an emergency | | Is it a false positive? | False positives happen. Once checked and marked, they should not reappear with every scan | A finding in the backup almost always means the finding is also still on the system that was backed up. It is examined and removed there with the regular antivirus; the backup stays as it is. ## Virus scanning and traces of ransomware Signatures find known malware. Ransomware often stands out differently: through files whose content does not match the extension or looks random, through typical extensions and through ransom notes. Both together, as part of a regular restore test (https://aegisgrid.de/en/guides/testing-restores/), give the fuller picture. ## How AegisGrid scans backups for viruses The AegisGrid backup server (https://aegisgrid.de/en/backup-server/) scans backups in the check restore with ClamAV, read-only and without load on the system that was backed up. For a finding it names the affected file and signature, the first backup containing it and the last backup without it; the finding appears in the check report, a notification goes out and, for file and drive backups, the scheduler on the backed-up machine also shows a notice. False positives can be marked. Follow-up scans can be limited to changed files and check everything at fixed intervals. Backup servers without internet access receive the signatures via a site server or as an import. In addition, the check restore looks for traces of ransomware. ## Frequently asked questions about scanning backups **Is an infected backup deleted or cleaned?** No. The scan only reads. The backup remains unchanged and can still be used, for example to take individual clean files from it or to trace the infection. **Does the scan slow down my servers?** No. The scan runs on the backup server, not on the system that was backed up. There, CPU time, memory and disk access can be limited for the scan job. **Does scanning the backups replace antivirus?** No. It complements it: antivirus protects the running systems, scanning the backups shows whether a finding detected later is already in older restore points and which restore point is clean. ## Backups you can trust In a pilot project we set up check restores and virus scanning on your backup server with you. Request a pilot project (https://aegisgrid.de/en/contact/?thema=pilot) --- Source: https://aegisgrid.de/en/guides/testing-restores/ Guide · Recovery # Testing restores: only the test makes a backup In short: “backup successful” only means that data was written – not that a system will start from it again. Only a regular, documented restore test shows whether a backup holds up in an emergency. It is most reliable when it runs automatically. By Uwe J. Solleder (https://aegisgrid.de/en/about-us/#uwe-solleder), Managing Director of MSD Computersysteme GmbH · Published on 2026-10-27 · updated on 2026-11-01 ## Why backups fail in an emergency Most failed restores have unspectacular causes that no success message reveals: - A new hard disk or a new drive was never added to the backup. - The database was backed up in the middle of writing and does not start cleanly. - The key for an encrypted backup can no longer be found. - A folder has shrunk unnoticed over months because an application stores its data elsewhere. - The virtual machine starts but hangs at an error screen. - Nobody remembers in which order the systems have to start. ## What a good restore test checks | Stage | What is checked | What it finds | | Data readable | Every stored object is read and compared with its checksum | Damaged or missing data in the store | | Restorable | The backup is restored in full to a test area | Missing parts, wrong keys, too little space | | File system intact | Every file system is checked and mounted | Inconsistent backups, defective partitions | | Content plausible | Every file is read, files and data volumes are counted and compared with the last test | Unreadable or unnoticed changed files, shrunken, empty or outdated areas | | Free of ransomware traces | Files are examined for signs of encryption: content does not match the extension or looks random, typical extensions and ransom notes | Backups that already contain encrypted data | | System starts | The virtual machine boots in an isolated environment | Systems that do not boot, error screens | | Service responds | A service such as the directory, mail or database accepts connections | Systems that start but do not work | ## How often to test? There is no statutory interval, but laws such as NIS2 and the GDPR require regular testing of the measures. The following has proven itself: - **Daily to weekly:** a check of the stored data, for large stores only of the newly added data. - **Weekly:** a spot check – a few randomly chosen backups are restored in full and started. - **At least once a year:** a test of the most important systems in the right order, with the time until they are working again measured. More important than the frequency is that every test is **documented**: when, which backup, which result. A test without evidence does not count in an audit. ## Testing without risk to operations A restored machine must never talk to the real network: a second domain controller or mail server with the same name can cause great damage during live operation. That is why check restores belong in an isolated environment – without a network or in a network of their own with no connection to the outside. Dependent systems start there in the right order, for example first the domain controller, then the mail server. ## How AegisGrid automates this The AegisGrid backup server (https://aegisgrid.de/en/backup-server/) runs the check restore as a workflow, for example every Saturday morning on three randomly chosen backups: restore, check the file systems read-only and mount them, read every file and compare with the last check, start virtual machines in an isolated QEMU/KVM environment, check whether they show a picture, write to their disks or their services respond, and clean up afterwards. The check report arrives by email with a traffic light per disk and partition and screenshots of the started machines; every test is recorded with its result in the signed evidence log (https://aegisgrid.de/en/evidence/) and in the monthly report. ## Frequently asked questions about restore tests **Is it enough to verify the backup's checksums?** No. A checksum check shows that the stored data is unchanged. Whether the backup is complete and a system starts from it is shown only by a restore. **Does a check restore need its own test environment?** It needs storage space for the restored data and, to start virtual machines, a computer with hardware virtualisation. The AegisGrid backup server brings the isolated environment with it; a separate test infrastructure is not needed. **Can encrypted backups be tested as well?** Yes, the testing server needs the key for that. Without the key, checking the stored data, mirroring and cleaning up remain possible. ## See a check restore on your systems In a pilot project we restore your backups as a test – with a report and screenshots. Request a pilot project (https://aegisgrid.de/en/contact/?thema=pilot) --- Source: https://aegisgrid.de/en/guides/veeam-alternative/ Guide · Comparison # A Veeam alternative from the EU: a factual comparison In short: Veeam is a mature product with a wide range of features, especially for VMware vSphere. AegisGrid is an alternative for companies that want to back up Hyper-V, Proxmox VE, Xen, Windows and Linux servers and Microsoft 365 with one tool from an EU provider – with further processing on the backup server and signed evidence. Anyone who needs to back up VMware vSphere needs a different tool today. By Uwe J. Solleder (https://aegisgrid.de/en/about-us/#uwe-solleder), Managing Director of MSD Computersysteme GmbH · Published on 2026-10-27 · updated on 2026-11-07 ## The main differences The information on Veeam comes from publicly available manufacturer information (sources below), as of October 2026. Features may differ depending on edition and version. | Feature | AegisGrid | Veeam Backup & Replication | | Provider / headquarters | MSD Computersysteme GmbH, Germany | Veeam Software, Kirkland (Washington), USA | | Whole virtual machines | Hyper-V, Proxmox VE (LVM, LVM-thin, ZFS, Ceph RBD, qcow2), Xen | including VMware vSphere, Hyper-V, Proxmox VE | | Microsoft 365 | In the same tool (Exchange Online, OneDrive, SharePoint) | Separate product (Veeam Backup for Microsoft 365) | | Resuming after an interruption | Automatic, even after standby or shutdown; only the rest is transferred | Partly (Veeam Agent, scheduled volume backups) | | Immutable backups | WORM with retention lock | Hardened Repository | | Encryption before transfer | AES-256-GCM or ChaCha20-Poly1305 | Yes | | Deduplication | Content-defined, across all backups of a store | Yes | The full comparison with other solutions such as Acronis, Proxmox Backup Server, restic and BorgBackup can be found on the Comparison (https://aegisgrid.de/en/comparison/) page. ## When AegisGrid is a good fit - **A provider in Germany matters to you:** software, support and, if you wish, Managed Backup (https://aegisgrid.de/en/managed-backup/) and cloud storage (https://aegisgrid.de/en/cloud-storage/) come from the EU, with a data processing agreement. - **Mixed environments without VMware:** Hyper-V, Proxmox VE and Xen, Windows and Linux servers and Microsoft 365 with one method and into the same stores. - **Laptops and slow connections:** interrupted backups always continue where they left off. - **Evidence for NIS2 and the BSI:** a chained, signed evidence log (https://aegisgrid.de/en/evidence/) with a monthly report and SIEM connection. - **Further processing on the backup server:** checking, mirroring, exporting and check restores run as workflows triggered by incoming backups – see Backup server (https://aegisgrid.de/en/backup-server/). - **A direct line:** questions reach the people who develop the software. ## When Veeam may be the better choice - **VMware vSphere** is in use – AegisGrid does not back up vSphere. - **Hyper-V failover clusters with CSV** – AegisGrid currently supports single Hyper-V hosts. - **Restoring Microsoft 365 directly into the tenant** – AegisGrid currently restores Microsoft 365 as an export. - Your team is well versed in Veeam, and there is no reason to switch. ## Planning the switch A switch does not have to happen on a fixed date. A proven approach is to run AegisGrid in parallel for selected systems first, practise restores and let the old backups expire with their retention period. In a pilot project (https://aegisgrid.de/en/contact/?thema=pilot) we check in advance whether all your systems are covered. ## Sources - Veeam: Hardened Repository (https://helpcenter.veeam.com/docs/vbr/userguide/hardened_repository.html), Veeam Backup for Proxmox VE (https://helpcenter.veeam.com/docs/vbproxmoxve/userguide/deployment.html), Veeam Backup for Microsoft 365 (https://helpcenter.veeam.com/docs/vbo365_aws/deployment/welcome.html), Veeam Agent – automatic retry (https://helpcenter.veeam.com/docs/agentforwindows/userguide/scheduled_backup_retry.html), Locations (https://www.veeam.com/company/contacts.html) Veeam, VMware, vSphere and other product names mentioned are trademarks or registered trademarks of their respective owners. They are mentioned solely for the purpose of a factual comparison; there is no business relationship. We welcome any notes on outdated information. ## Frequently asked questions about switching from Veeam **Can AegisGrid read Veeam backups?** No. Existing Veeam backups remain readable with Veeam until they expire at the end of their retention period. New backups are made with AegisGrid. **Can I test AegisGrid alongside Veeam?** Yes. Both can run side by side as long as the backup windows do not interfere. Schedule them so that they do not both back up the same VM at the same time. ## Is AegisGrid right for your environment? In a pilot project we check this on your own systems – before you decide. Request a pilot project (https://aegisgrid.de/en/contact/?thema=pilot) --- Source: https://aegisgrid.de/en/legal-notice/ # Legal notice This is a translation for your convenience. Only the German version (https://aegisgrid.de/impressum/) is legally binding. ## Information pursuant to § 5 DDG (German Digital Services Act) MSD Computersysteme GmbH Grunerstraße 41 40239 Düsseldorf Germany ## Represented by Managing Director: Uwe Solleder ## Contact Phone: +49 211 21099-0 Email: the contact form at https://aegisgrid.de/en/contact/ ## Register entry Register court: Amtsgericht Düsseldorf (Düsseldorf Local Court) Register number: HRB 82077 ## VAT identification number VAT identification number pursuant to § 27a of the German VAT Act: DE140299160 ## Responsible for the content pursuant to § 18(2) MStV Uwe Solleder Grunerstraße 41, 40239 Düsseldorf, Germany ## Trademarks AegisGrid is a brand of MSD Computersysteme GmbH. Other product and company names mentioned on this website are trademarks of their respective owners; they are mentioned solely for factual information. ## Consumer dispute resolution We are neither willing nor obliged to take part in dispute resolution proceedings before a consumer arbitration board. ## Liability for content As a service provider we are responsible for our own content on these pages under the general laws. We are, however, not obliged to monitor third-party information transmitted or stored, or to investigate circumstances that indicate illegal activity. As soon as we become aware of an infringement, we remove the content concerned without delay. ## Liability for links This website contains links to third-party websites whose content we cannot influence. The respective provider is responsible for this content. No infringements were apparent at the time of linking; if we become aware of any, we remove the link without delay. ## Copyright The texts, graphics and design of this website are subject to German copyright law. Any use beyond the limits of copyright law requires our prior consent. The typeface Inter is licensed under the SIL Open Font License 1.1. --- Source: https://aegisgrid.de/en/managed-backup/ Managed Backup # Backup as a service from the EU. We install AegisGrid at your premises, keep the backup servers and backup agents up to date and regularly check whether your backups can be restored. You decide where the backups are kept. Ask about Managed Backup (https://aegisgrid.de/en/contact/?thema=managed) ## What we take care of for you You keep control of your data and keys. We take care of running the backup. ### Installation We analyse your systems, set up schedules, retention and destinations, and install the backup servers and backup agents. ### Updates We keep the backup servers and backup agents up to date. Updates are signed and applied in a controlled way. ### Restore tests We regularly check whether your backups can be restored – supported by the automatic check restore (https://aegisgrid.de/en/backup-server/) of the backup server and with a record for your files. ### Monitoring We check the results of the backups, react to errors and get in touch before a problem becomes an emergency. ### Help in an emergency Whether a single file or a whole server: we restore it together with you. ### Personal support Permanent contacts in Germany who know your environment – and direct lines to development. ## Your backups are kept where you want them Managed Backup is a service for running your backup, not a storage location. The backups are kept on destinations of your choice: on storage at your premises, on your own backup server at a second site or – if you wish – in the AegisGrid cloud storage (https://aegisgrid.de/en/cloud-storage/) in certified data centres in Germany. For the work on your systems we conclude a data processing agreement with you under Art. 28 GDPR. - **Storage location:** freely selectable, also only on your own premises - **Operation:** MSD Computersysteme GmbH, Germany - **Software:** developed in Germany - **Encryption:** AES-256 on your systems, TLS in transit - **Contract:** data processing under Art. 28 GDPR - **Protection:** immutable copies if you wish ## How we get started From the first conversation to running operation in four steps. - ### Conversation We clarify systems, amounts of data, storage locations, retention periods and your requirements for the time to restore. - ### Pilot project We back up selected systems and restore them as a test – with measured times. - ### Offer You receive an offer that fits your environment – transparent and predictable. - ### Operation We install, keep everything up to date and test the restore. You receive regular reports. ## Questions about Managed Backup **Where are my backups kept with Managed Backup?** Wherever you decide: on your premises, at a second site of your own or in the AegisGrid cloud storage. Managed Backup concerns the operation, not the storage location. For an off-site copy we recommend a second site or the cloud storage (https://aegisgrid.de/en/cloud-storage/). **Do I need the cloud storage for Managed Backup?** No. Managed Backup and cloud storage are independent of each other. You can use one without the other or combine both. **Can the operator read my data?** If you use encryption with a key of your own, the data is encrypted on your systems before it is written or transferred. Without the key, the backed-up content cannot be read. How the key is kept – only by you or additionally deposited for emergencies – we decide together. **What does Managed Backup cost?** The price depends on the number of systems and the scope of services you want. After a conversation and, if you wish, a pilot project, you receive an offer with predictable monthly costs. ## Let's talk about your backup Without obligation and in person – by phone or at your premises. Ask about Managed Backup (https://aegisgrid.de/en/contact/?thema=managed) +49 211 21099-0 --- Source: https://aegisgrid.de/en/partners/ Partner programme # Together for backups you can trust. AegisGrid is built as a team: we develop, and our partners recommend it, look after customers, help shape its development or run backup servers – each in the way that suits them. Four tiers from Bronze to Platinum make every contribution visible, because skills, contribution and customer revenue count equally. Register as a partner now (https://aegisgrid.de/en/partners/register/) ## Who the partner programme is for ### IT service providers You plan, install and look after IT environments and want to offer backup as a fixed part of your services. ### Managed service providers You run your customers' IT and are looking for a backup solution that you operate yourself or combine with our Managed Backup and cloud storage. ### IT consultants You advise on information security, data protection or NIS2 and want to recommend a suitable implementation to your customers. ### Site partners You run a data centre and provide publicly reachable AegisGrid backup servers – for example as the destination for the off-site copy. ## Three ways up Not every partner wants to look after customers themselves – and nobody has to. Whatever you contribute, you collect as contribution points: Silver from 25, Gold from 50 and Platinum from 100 points. ### Skills Every completed training counts – permanently. - Fundamentals and technical training - Specialisations of your choice - Operating backup servers ### Contribution You move AegisGrid forward with us – even without any customers of your own. - Mentoring new partners - Testing new versions - Guides, case studies, reference customers - Talks at the partner meeting ### Customer revenue What your customers use – looked after or recommended. - Your customers' licences - Customers you recommended – even if others look after them - Storage used at site partners and in the cloud storage **You do not have to report anything:** we record your points ourselves and send you an overview every quarter. Contribution and customer revenue each count for twelve months, training permanently. ## Four tiers – every contribution counts The tier shows how much you contribute to our shared success. With every tier, what we do for you grows. ### Bronze With the fundamentals training you are on board. - Partner support from MSD - A mentor at your side - Invitation to the partner meeting ### Silver From 25 points your contribution becomes visible. - Listing as a partner on aegisgrid.de - Your training certificates at a glance ### Gold From 50 points we work more closely together. - Direct line to development - Enquiries passed on to match your certificates - Early insight into our plans ### Platinum From 100 points we invite you personally. - A dedicated contact and priority handling - Prominent listing, enquiries passed on with priority - A part in planning AegisGrid ## The tiers compared Each tier includes everything from the tiers below. A tier you have reached applies for at least twelve months. --- Source: https://aegisgrid.de/en/partners/register/ Partner programme # Register as a partner Briefly introduce your company to us. Registration is non-binding – we will get in touch with you personally and discuss everything else in a conversation. --- Source: https://aegisgrid.de/en/privacy/ # Privacy policy In short: this website sets no cookies, uses no tracking and loads nothing from third-party servers. We only process personal data as far as it is needed to run the website and answer your requests. This is a translation for your convenience. Only the German version (https://aegisgrid.de/datenschutz/) is legally binding. ## 1. Controller The controller for the processing of data on this website within the meaning of the General Data Protection Regulation (GDPR) is: MSD Computersysteme GmbH Grunerstraße 41 40239 Düsseldorf, Germany Phone: +49 211 21099-0 Email: the contact form at https://aegisgrid.de/en/contact/ This policy applies to the website aegisgrid.de. The processing of backup data as part of Managed Backup and cloud storage is governed by the data processing agreement under Art. 28 GDPR concluded with you. ## 2. Hosting and server logs The website is run on servers of MSD Computersysteme GmbH in Germany; no external hosting provider is involved. The connection is encrypted throughout with HTTPS. With every request, your browser transmits data to our server for technical reasons. The server stores it in log files: - the IP address of the requesting device, - the date and time of access, - the address requested and the HTTP status code, - the amount of data transferred, - where applicable, the page visited before (referrer) and the identifier of the browser. We use this data solely to ensure secure and stable operation, to fix faults and to fend off attacks. It is not evaluated for advertising or analysis purposes, nor combined with other data. The logs are deleted automatically after 14 days. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure operation of the website. ## 3. Contact form, partner registration and email If you write to us through the contact form or by email, we process the details you give us: name, email address, your message and, voluntarily, company, phone number and subject. We use them solely to answer your request. If you register through the partner registration form, we process the company, contact person, email address and postcode with town as well as, voluntarily, phone number, website, type of company, number of customers looked after, focus areas, your experience with backup systems at customers (whether, at how many customers and which), your interest in Managed Backup and your message. We use them solely to review your registration and to discuss the partnership with you. Everything below applies to this form as well. The details from the forms are sent as an email through our own mail server to our mailbox and are not stored in a database of the website. You do not receive an automatic confirmation email; this way nobody can misuse the forms to send messages to other people's addresses. To protect against mass automated requests, the server stores, when you submit, a check value (hash) of your IP address formed with a secret key and the times of the requests for at most one hour. The IP address cannot be recovered from the check value; it is deleted afterwards. The legal basis is Art. 6(1)(b) GDPR if your request or registration aims at a contract, a pilot project or a partnership, and otherwise Art. 6(1)(f) GDPR; our legitimate interest lies in answering requests and protecting the forms against misuse. Providing your data is voluntary; without an email address, however, we cannot reply to you. We delete your request as soon as it has been dealt with conclusively and no statutory retention obligations stand in the way. If a business relationship arises from the request, we keep business correspondence in accordance with commercial and tax law (§ 257 HGB, § 147 AO; six or ten years). ## 4. No cookies, no tracking, no external services This website sets no cookies. It only stores something in your browser's storage if you close the notice about another language version of this website: an entry “aegis-lang-notice”, so that the notice does not appear again. This entry never leaves your device, and you can delete it in your browser at any time. We use no analytics or advertising services, no social media plugins, no embedded maps or videos and no content delivery network. Fonts, graphics and scripts are loaded exclusively from our own server; no data is therefore transmitted to third parties when you visit. ## 5. Recipients and transfer to third countries Your data is processed only by us. It is not passed on to third parties unless we are legally obliged to do so. No data is transferred to countries outside the European Union. ## 6. Your rights You have the right at any time to - access the data stored about you (Art. 15 GDPR), - rectification of incorrect data (Art. 16 GDPR), - erasure (Art. 17 GDPR), - restriction of processing (Art. 18 GDPR), - data portability (Art. 20 GDPR). **Right to object:** where we process data on the basis of Art. 6(1)(f) GDPR, you can object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR). For all data protection matters, an informal message to the contact form at https://aegisgrid.de/en/contact/ or to our postal address is sufficient. ## 7. Complaint to a supervisory authority You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW) Kavalleriestraße 2–4 40213 Düsseldorf, Germany www.ldi.nrw.de (https://www.ldi.nrw.de/) ## 8. Automated decisions There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR. ## 9. Changes We adapt this privacy policy when the website or the legal situation changes. The version published here applies. As of: October 2026 --- Source: https://aegisgrid.de/en/security-privacy/ Security & privacy # For us, security is not an extra but the foundation. A backup contains a company's most valuable data. That is why AegisGrid has been built from the start so that data stays protected, unaltered and under German law. ## Protection on every level ### Encrypted before data leaves your premises The data is encrypted on the backed-up system with AES-256-GCM or ChaCha20-Poly1305. Both methods are authenticated: a wrong key or altered data is reliably detected during the restore. ### The key in your hands The key is created and kept at your premises. Without it, an encrypted store reveals nothing about its contents – not even to whoever runs the storage. ### Protected transfer The connection to the backup server is TLS-encrypted, and its certificate is pinned. Access uses API keys that are only valid for certain directories. ### Immutable backups In WORM storage, written data is never changed; backups are locked against changes and deletion until a set point in time. That way an intact version remains even after an attack. ### Separated privileges on the server Only a few parts of the backup server run with elevated privileges; the data is processed under a separate, unprivileged account. ### Signed updates Updates and components are signed with Ed25519, packages are bound by checksums, and older versions are not installed again. Only what the signature confirms is installed. ### Audit-proof evidence log The backup server records every backup, restore, check and deletion in a chained, daily signed log – with a copy to your SIEM at once, if you wish. More about the evidence (https://aegisgrid.de/en/evidence/) ### Restore without dependence Your licence is stored signed on your systems and works without a permanent connection to us. If it ends, only new backups stop: existing ones can still be restored from your own backup servers and destinations, and nothing is ever deleted because of a licence. ## Data protection under the GDPR AegisGrid is developed by MSD Computersysteme GmbH in Germany. In Managed Backup and the cloud storage we process your data as a processor under Art. 28 GDPR – on the basis of a contract that sets out the purpose, scope and the technical and organisational measures. You decide where your backups are kept – on your own servers, NAS storage or at a second site, for example. If you use the AegisGrid cloud storage (https://aegisgrid.de/en/cloud-storage/), the backup data is kept there exclusively in certified data centres in Germany; no data is transferred to third countries. - Provider based in Germany - Development in Germany - Operation and support by our own staff in Germany - Cloud storage in certified data centres in Germany - Freely selectable storage locations, also only on your own premises - Data processing agreement - No transfer to third countries ## Support with legal requirements AegisGrid provides technical building blocks for requirements that many companies have to meet. | Requirement | Content | What AegisGrid contributes | | GDPR Art. 32(1)(b) | Confidentiality, integrity, availability and resilience of the systems | Encryption, authenticated methods, copies in several places | | GDPR Art. 32(1)(c) | Timely restoration after an incident | Every version restorable on its own, a local copy for short restore times | | GDPR Art. 32(1)(d) | Regular testing of the measures | Checks of all stored objects, automatic check restores, results by email, test restores in Managed Backup | | NIS2 Directive Art. 21(2)(c) | Backup management and disaster recovery | Scheduled backups, immutable copies, automatic check restores and a signed evidence log with a monthly report | | BSI IT-Grundschutz CON.3 and OPS.1.1.5 | Backup concept and logging | Records of regularity, retention, deletions and restore tests; a tamper-proof log with a copy in a second place | No software alone fully meets these requirements – they are part of an overall concept of technology and organisation. We will gladly advise you on which measures make sense for your company. How the backup server provides evidence of backups for NIS2, critical infrastructure and BSI IT-Grundschutz is shown on the evidence (https://aegisgrid.de/en/evidence/) page. ## Questions about security or data protection? We will gladly provide further documents, such as the data processing agreement. Get in touch (https://aegisgrid.de/en/contact/?thema=beratung) --- Source: https://aegisgrid.de/en/solutions/ Solutions # Backup for every role in the company A backup has to meet three demands: it has to protect the company, fit into a strategy and run reliably every day. Choose your perspective. Updated on 2026-11-07 Management ## Stay able to act What a loss of data costs, which duties the GDPR and NIS2 place on management, and why the provider's location matters. Read more (https://aegisgrid.de/en/solutions/management/) IT management ## Put the strategy into practice 3-2-1-1-0 with one tool: several destinations, immutable copies, checks, retention rules and reports. Read more (https://aegisgrid.de/en/solutions/it-management/) Administration & engineering ## Run it reliably Methods, platforms, consistency, networking, automation – the technical details at a glance. Read more (https://aegisgrid.de/en/solutions/administrators/) By area of use ## Notebooks and mobile workplaces The devices of sales, authorised signatories, management and the board are rarely in the office and are often backed up insufficiently. AegisGrid backs them up in the background on the road and continues every interrupted backup. ### Backed up, even when the notebook is closed Carries on after standby, power-off or a flat battery – only what is still missing is transferred. Read more (https://aegisgrid.de/en/solutions/notebooks/) ## Would you rather talk it over in person? We take time for your environment and your requirements – without sales pressure. Ask for advice (https://aegisgrid.de/en/contact/?thema=beratung) --- Source: https://aegisgrid.de/en/solutions/administrators/ For administration and engineering # Technology you can follow. No black box: here is how AegisGrid works – from splitting the data through encryption and transfer to restoring whole virtual machines. Updated on 2026-11-13 ## How a backup is made Reading, chunking, hashing, compressing and writing run as a parallel pipeline. One run serves up to eight destinations; the source is read only once. - ### Read consistently VSS shadow copy on Windows, LVM snapshot on Linux, plus freely selectable pre/post hooks for databases and applications. Free areas of NTFS and ext2/3/4 are skipped. - ### Chunk by content FastCDC splits the data into chunks of 256 KiB on average. Moved or inserted data only changes the chunks affected. - ### Check and compress Every chunk gets an ID (SHA-256, BLAKE3 or XXH3-128). Only unknown chunks are compressed with zstd or lz4 and encrypted. - ### Transfer securely The agent streams over TLS to the backup server, whose certificate is pinned. Only what the destination is missing is transferred. ## Technical data | Deduplication | Content-defined (FastCDC), chunk size 256 KiB on average, adjustable per store; deduplicated across all backups of a store, also across computers | | Chunk IDs | BLAKE3 (default for new stores), SHA-256 (hardware-accelerated) or XXH3-128; with encryption, key-dependent IDs | | Compression | zstd (default, optionally with an adaptive level), lz4 or none – per chunk | | Encryption | AES-256-GCM or ChaCha20-Poly1305 per store; key as a file, directly or through a key service | | Transfer | TLS with certificate pinning, API keys per directory, automatic reconnection after a lost connection within the same run | | Resump­tion | Always active: a state file per job, continuation after a crash, shutdown or power failure at system start; the snapshot or persistent shadow copy is kept where possible; only what the destination is still missing is transferred | | Backup server | Linux; privileged parts separated, data processing runs under a separate, unprivileged account; its own scheduler for jobs on events, on a schedule and in flows | | Check restore | Restore as a test, read-only file system check (ext2/3/4, xfs, btrfs, vfat, ntfs, LVM in the image) per disk and partition, counting with a loss threshold, reading every file with a checksum (SHA-256, BLAKE3 or XXH3-128) and comparison with the last check, ransomware signs (file signature, entropy, extensions, ransom notes), VM start in QEMU/KVM without a network or in an isolated network, check by screen, guest agent or TCP port, one report per check chain with traffic lights and screenshots | | Evidence | Log as JSON Lines with a SHA-256 chain, daily Ed25519 seal, copy via syslog (RFC 5424, UDP/TCP/TLS) or to a second backup server, export as CSV/JSON and a monthly report as a PDF, each signed | | Consistency | VSS (Windows), LVM snapshots (Linux), pre/post hooks | | Kinds of backup | Files, volumes, partitions, whole disks, images; zero areas are recorded as gaps and not stored | | Protection | WORM locks, check of all objects (scrub), repair from a second copy, mirroring of whole stores, export of single backups as an archive | | Restore | Every version on its own, parallelised; partial restore even of damaged backups; VMs as a new VM or disk by disk, also directly from the server; Proxmox and Xen VMs also in place, optionally only changed blocks | | Operating systems | Windows and Linux for agent, restore, job scheduler and updates; backup server on Linux; management console and target console on Windows; web interface for job scheduler and backup server in the browser | ## Virtualisation and cloud Virtual machines are backed up as a whole: all disks and the configuration in one run. ### Hyper-V The basis is a recovery checkpoint, application-consistent through VSS in the guest. All virtual hard disks and the state files including vTPM are backed up. Thanks to Resilient Change Tracking, follow-up backups only read changed areas. ### Proxmox VE Whole VMs with all disks, UEFI variables, vTPM state and configuration on LVM, LVM-thin, ZFS, Ceph RBD and qcow2 (directory, NFS, CIFS). With the QEMU guest agent, the guest is briefly frozen across all disks together. Thanks to change tracking (CBT), follow-up backups read only what changed. Restore as a new VM, disk by disk or in place. ### Xen VMs on Xen (xl) with all disks and configuration, short freeze windows for the guest, restore as a new VM or in place. ### Microsoft 365 Through Microsoft Graph with an app registration of your own in Entra ID: mailboxes with mail, calendar, contacts and tasks, OneDrive and SharePoint – incremental, for single accounts or the whole tenant, with export of single items. ## Automation and operation The job scheduler runs as a service on Linux and as a Windows service on Windows. It starts jobs on a schedule or by dependency, also in parallel, and sends results by email. Through the documented HTTPS API, jobs can be created, started, paused and monitored – ideal for your own tools and monitoring. The backup server has its own HTTPS API with roles for reading and managing; if you wish, its evidence log goes straight to your SIEM via syslog. - Progress, pause and bandwidth limit for running backups - Maintenance jobs for clean-up, checks and mirroring, on the backup server triggered by incoming backups - Schedules as cron or RFC 5545 rules, with holiday calendars, time windows and catching up on missed runs - Configuration changes through the API by email with the changed lines, earlier versions kept - Installation by setup, updates signed and scheduled - Diagnostics package with one command for support - Progress display on the Windows desktop ## Questions from administrators **How does deduplication work in AegisGrid?** AegisGrid splits the data by content with FastCDC into chunks of 256 KiB on average and computes an ID for every chunk. Only chunks whose ID does not yet occur at the destination are stored and transferred. This applies across all backups of a store, also between different computers. **What happens if the connection drops during a backup?** The next backup continues where the interrupted one stopped; chunks already transferred are not sent again. If one optional destination of several fails, the others keep running. **Are there chains of full and incremental backups?** No. Every backup is a complete version that can be restored on its own. The labels “full” and “incremental” are only for orientation; internally there are no dependencies between the versions. **How do I get a deleted file back?** In the management console: choose the backup, choose the point in time, tick the files, write them to the original location or to another folder. On the command line, bkp_restore --list shows all backups of the computer and bkp_restore --sinks which destinations can be reached right now. --files find "*offer*" searches across all versions, --files versions shows the versions of a file, --files restore … --original writes it back. If the search finds nothing, it names the likely reasons, such as an exclusion or a folder outside the backup. ## Talk to the developers Technical questions are answered by the people who build AegisGrid. Ask a technical question (https://aegisgrid.de/en/contact/?thema=technik)Request a pilot project (https://aegisgrid.de/en/contact/?thema=pilot) --- Source: https://aegisgrid.de/en/solutions/it-management/ For IT management # A backup strategy that works out in an emergency. AegisGrid puts proven rules such as 3-2-1-1-0 into practice with a single tool: several destinations in one run, immutable copies, regular checks, automatic check restores, clear retention and a signed log that shows what happened. Request a pilot project (https://aegisgrid.de/en/contact/?thema=pilot)All features (https://aegisgrid.de/en/features/) Updated on 2026-11-07 ## The 3-2-1-1-0 rule with AegisGrid The German Federal Office for Information Security (BSI) recommends the 3-2-1 rule: three copies, two media, one off site. The 3-2-1-1-0 rule adds an immutable copy and zero errors in the check. With AegisGrid, everything is created in a single run – and on the backup server every step is documented in the evidence log (https://aegisgrid.de/en/evidence/). Diagram: the server fs01 is read once. AegisGrid deduplicates and encrypts the data and sends each destination only what it is missing: to a USB disk on site, to a backup server on site with a WORM lock until expiry and to a backup server off site or the cloud storage – up to eight destinations in one run. Below it the rule: 3 copies (original and destinations), 2 media (disk and server), 1 off site (second location), 1 immutable (WORM lock), 0 errors (check, check restore). Read once, up to eight destinations: the 3-2-1-1-0 rule in a single run.Swipe sideways to see the whole diagram. | Rule | Meaning | Implementation with AegisGrid | Evidence | | 3 copies | The original plus two backups | Up to eight destinations in one run; the source is read only once. | Every incoming copy in the log of the backup server | | 2 media | Different storage | Local storage, USB disk, backup server in the network, cloud storage or export to tape. | Destinations and result per run, exports in the log | | 1 off site | One copy at another location | Encrypted transfer over TLS to a remote backup server or to the AegisGrid cloud storage; alternatively mirroring from the backup server on site. | Arrival and mirroring with computer, address and amount of data | | 1 immutable | Offline or locked against deletion | WORM storage with a retention lock; export of single backups as an archive. | Every deletion and every change of the retention | | 0 errors | Verified recoverability | Check of all stored objects, comparison with the original, repair from a second copy and automatic check restore that starts the VMs in a sandbox. | Checks, damage and check restores with their result, monthly as a signed report | ## What makes the difference in operation ### No backup chains Every run is a complete version that can be restored on its own. There is no dependence on earlier full or incremental backups and no merging – a damaged intermediate version does not endanger the following ones. ### Little storage, little bandwidth Thanks to deduplication, only what the destination is still missing is transferred and stored – also between computers with similar data. Free areas of NTFS and ext file systems are skipped. ### Scheduling and dependencies The job scheduler starts backups on a schedule or after other jobs have finished, also in parallel, and sends results by email. Running backups can be paused or limited in bandwidth. ### Retention by rules Every backup carries its own retention period in days, weeks, months or years – different per destination, seven days locally and twelve months in the cloud storage, for example. A scheduled maintenance job cleans up expired versions; locked versions remain until their lock ends. ### Robust against interruptions If a transfer breaks off, the next backup continues there instead of starting from scratch. If an optional destination fails, the others keep running. ### Secure updates Updates and components are signed with Ed25519; only what the signature confirms is installed. Old versions are not installed again. ## One solution for the whole environment Instead of separate tools per platform, AegisGrid backs up physical servers, virtual machines and Microsoft 365 with the same method and into the same stores. That simplifies documentation, training and emergency planning. For connecting your own tools, the job scheduler provides a documented HTTPS API. - Windows Server with VSS shadow copies - Linux servers with LVM snapshots - Hyper-V, application-consistent through recovery checkpoints - Proxmox VE and Xen: whole VMs with all disks - Microsoft 365: Exchange Online, OneDrive, SharePoint ## Questions from IT management **Can AegisGrid back up locally and off site at the same time?** Yes. One run can serve up to eight destinations, a local store and a remote backup server or the cloud storage, for example. The source is read only once, and every destination stores only what it is still missing. **How do we prove that backups can be restored?** AegisGrid checks all stored objects for integrity and, on Linux, can compare a backup with the snapshot it was read from. Results go to the people responsible by email. The backup server also regularly restores backups as a test, checks the file systems and starts virtual machines in an isolated sandbox; the check report comes with screenshots. Everything together is in the signed evidence report (https://aegisgrid.de/en/evidence/). With Managed Backup we set this up for you and evaluate it. **Can AegisGrid be integrated into existing monitoring?** Yes. Results arrive by email, and the job scheduler offers an HTTPS API through which jobs, progress and results can be queried. ## Test AegisGrid on your own systems In a pilot project we back up selected servers and VMs and restore them as a test – with measured times. Request a pilot project (https://aegisgrid.de/en/contact/?thema=pilot) --- Source: https://aegisgrid.de/en/solutions/management/ For management # Backup is a matter for the boss. An encryption attack, a fire or an operating error – without a working backup, a company comes to a standstill. AegisGrid makes sure you stay able to act and gives you the evidence that legislators and insurers expect. Arrange a consultation (https://aegisgrid.de/en/contact/?thema=beratung) Updated on 2026-11-07 ## What is at stake? Without data there are no orders, no invoices, no payroll. What matters is not whether a backup exists, but whether it can be restored quickly and completely in an emergency – and whether an attacker was able to make it useless beforehand. AegisGrid is designed for exactly this question: every backup is complete in itself, can be locked against deletion and checked regularly for integrity. - **Protection against ransomware:** immutable backups (WORM) that cannot be deleted until a lock expires. - **A second copy off site:** back up locally and to a second site or the cloud storage in one run. - **Provable quality:** checks of the stored data, automatic check restores and a signed evidence report every month – more about the evidence (https://aegisgrid.de/en/evidence/). - **Traceable:** deletions and interventions in the backups are logged, changes to the configuration arrive by email. - **No dependence:** your own backups can be restored even after the licence has expired; nothing is ever deleted because of a licence. - **Management's notebooks, too:** backups run in the background on the road and continue after every interruption – more about notebooks (https://aegisgrid.de/en/solutions/notebooks/). - **Predictable costs:** your own operation or Managed Backup – you decide. ## Duties you should know In many companies, backup is no longer a voluntary service but a legal requirement. ### GDPR, Art. 32 Requires the ability to restore the availability of and access to personal data in a timely manner after an incident – and regular testing of the measures. ### NIS2 Directive, Art. 20 and 21 Names backup management and disaster recovery explicitly as a minimum measure. Management must approve the measures and oversee their implementation. Operators of critical infrastructure must additionally prove their precautions to the national authority (in Germany, the BSI). ### Insurers and banks Cyber insurers and financing partners increasingly ask for separate, tested backups. AegisGrid provides the technical basis for this. AegisGrid supports you in meeting these requirements – with a signed evidence report (https://aegisgrid.de/en/evidence/) that documents backups, restores and check restores month by month. Whether your company falls under NIS2 and which measures are needed in detail depends on size and sector – we will gladly advise you. ## Why the provider's location matters Backups contain everything: customer data, contracts, personnel files, trade secrets. AegisGrid is developed in Germany by MSD Computersysteme GmbH, which has been providing IT services to mid-sized businesses since 1990. You decide where your backups are kept: on your own premises, at a second site or in the AegisGrid cloud storage – there exclusively in certified data centres in Germany. This means that software, operation and contract are subject to German and European law – without any transfer of your backup data to third countries. ### At a glance - Provider based in Germany - Development in Germany - Freely selectable storage locations, cloud storage in Germany - Data processing agreement (Art. 28 GDPR) - Personal contacts ## Questions from management **Do we need our own IT specialists for AegisGrid?** No. With AegisGrid Managed Backup, MSD Computersysteme GmbH takes care of installation, updates, monitoring and regular restore tests. If you have your own IT department or an IT service provider, they can also run AegisGrid. **How quickly can we work again after an attack?** That depends on the amount of data, the lines and the target systems. Every AegisGrid backup can be restored on its own, and a local copy shortens the restore considerably. In a pilot project we measure the restore time for your most important systems. **Do we automatically comply with NIS2 with AegisGrid?** No, no software alone makes a company NIS2-compliant. NIS2 requires a set of organisational and technical measures. AegisGrid supports the area of backup management and disaster recovery and provides evidence for it: a tamper-proof log, the results of checks and check restores and a signed monthly report. ## How good is your backup today? In a short conversation we clarify where you stand and what a pilot project can show you. Arrange a call (https://aegisgrid.de/en/contact/?thema=beratung) --- Source: https://aegisgrid.de/en/solutions/notebooks/ Notebooks and mobile workplaces # Backed up, even when the notebook is closed. Sales, authorised signatories, management and the board rarely work in the office – and their notebooks are often not backed up at all or only insufficiently. AegisGrid backs up in the background and, after every interruption, carries on where the backup stopped. Request a pilot project (https://aegisgrid.de/en/contact/?thema=pilot) Updated on 2026-11-07 ## The most important data is often the worst backed up Offers, calculations, contracts, presentations and the email of recent years: the notebooks of executives and field staff hold a lot that exists nowhere else in full. These are exactly the devices that are rarely in the office long enough to be backed up over the fast company network. With large amounts of data, a backup is not done in a few minutes – and whoever closes the notebook between two appointments does not think of the backup. With many solutions this means: the backup breaks off and starts from scratch next time. - **No involvement needed:** the backup runs on a schedule in the background, nobody has to start or watch anything. - **Interruptions are planned for:** closing the lid, shutting down or a flat battery cost no work already done. - **Only the rest is transferred:** what has arrived safely once never goes over the line a second time. - **No half backups:** a backup only counts as finished once it is complete. ## How it carries on after an interruption Resumption is always switched on. It needs neither to be set up nor to be triggered by the user. ### Lid closed or connection lost If the notebook goes into standby or the internet connection drops, AegisGrid reconnects by itself afterwards, checks what has already arrived and continues the same backup. ### Switched off or battery flat AegisGrid remembers every backup it has started. After the next start it picks it up again by itself; if there is no connection yet, the next scheduled run takes over. ### Continue instead of starting again Only what is still missing is transferred. This way, even a large first backup reaches its destination safely over several stages – at home, in the hotel or in the office. ## Unobtrusive in the background A backup must not disturb the work. AegisGrid shows consideration for the person at the device and for slow lines. - **Background mode:** low priority, and the busier the notebook is, the less the backup works. - **Limit the bandwidth:** so that video conferences and the mobile connection stay free. - **Pause at the push of a button:** a small progress window shows the running backup; whoever needs every second of performance right now pauses it. After an hour (adjustable) it continues by itself. During a presentation the window stays hidden. - **Missed dates are caught up:** if the notebook was off at the scheduled time, the backup starts after it is switched on. ## Secure on the road The data is encrypted on the notebook before it leaves it and is transferred over a secured connection to a pinned server. A public Wi-Fi only sees encrypted data. A suitable destination is your own backup server that the notebooks reach over the internet, or the AegisGrid cloud storage (https://aegisgrid.de/en/cloud-storage/): there the backups are kept in certified data centres in Germany. In both cases the notebook does not have to be in the company network. ### At a glance - Windows 10 and Windows 11 - Encryption before transfer - Transfer over TLS to a pinned server - Resumption after standby, power-off and a lost connection - Storage in Germany in the cloud storage ## Frequently asked questions about notebooks **What happens if the battery runs flat in the middle of a backup?** Nothing is lost. AegisGrid remembers the backup it started and picks it up again by itself after the next start. Only what had not arrived by then is transferred. An incomplete backup never results: only when everything is there does the backup count as finished. **Does the user have to do anything for this?** No. The backup runs on a schedule in the background, and resumption is always switched on. The user can pause a running backup in the progress window, but never has to. **Does the notebook slow down during the backup?** In background mode, AegisGrid works with low priority and steps back all the more, the busier the notebook is at the moment. In addition, the bandwidth can be limited. In a pilot project we tune both to your devices and lines. **Does it also work over hotel Wi-Fi or mobile networks?** Yes, as long as the connection allows outgoing traffic to the backup server. Some guest networks block individual ports; then the next backup with a suitable connection takes care of the rest. In a pilot project we check which connections your staff typically use. ## How well are your notebooks backed up today? In a pilot project we back up selected devices of your company – on the road, in the home office and in the office. Request a pilot project (https://aegisgrid.de/en/contact/?thema=pilot) --- Source: https://aegisgrid.de/en/specifications/ Specifications # AegisGrid in facts and figures In short: AegisGrid backs up Windows and Linux computers, virtual machines on Hyper-V, Proxmox VE and Xen, and Microsoft 365. Data is deduplicated by content, encrypted with AES-256-GCM or ChaCha20-Poly1305 before it is sent, and written to up to eight destinations in one run. The details are below. Updated on 2026-11-13 ## Platforms | Computers backed up | Windows 10, Windows 11 and Windows Server 2016, 2019, 2022 and 2025; Linux (x86-64, glibc 2.34 or later, tested with Debian 12 and 13, Ubuntu 22.04 and 24.04, Red Hat Enterprise Linux 9 and 10, AlmaLinux 9 and 10, Rocky Linux 9, SUSE Linux Enterprise Server 15 SP7 and 16, openSUSE Leap 16) | | Programs | Agent, restore, job scheduler and updates on Windows and Linux; backup server on Linux; management console and Target console on Windows; web interface for job scheduler and backup server in a current browser; on Linux, setup and updates install missing system packages with apt-get, dnf or zypper if wanted | | Hyper-V | Whole VMs through a recovery checkpoint, application-consistent through VSS in the guest, change tracking (RCT) for fast follow-up backups | | Proxmox VE | Proxmox VE 8 and 9; whole VMs with all disks, UEFI variables, vTPM state and configuration; storage LVM, LVM-thin, ZFS, Ceph RBD and qcow2 (directory, NFS, CIFS); short freeze through the QEMU guest agent; fast follow-up backups (CBT) through QEMU dirty bitmaps for all storage types; restore as a new VM, disk by disk or in place | | Xen | VMs on Xen (xl) with all disks and configuration, with memory if wanted (the restored VM carries on where it stood at the backup); restore as a new VM or in place | | Microsoft 365 | Exchange Online (mail, calendars, contacts, tasks), OneDrive and SharePoint through Microsoft Graph with your own app registration; restore as an export | ## Back up | Kinds of backup | Files and folders, volumes, partitions, whole disks, images, whole VMs, Microsoft 365 | | File backup | Up to 64 paths per profile, exclusion patterns and default exclusions; Linux: permissions, owners, times, extended attributes with POSIX ACLs, symbolic and hard links; Windows: attributes, times, owners and NTFS permissions, alternate data streams | | Consistency | Windows: VSS across all drives involved; Linux: LVM snapshot (ext2/3/4, XFS) or reading live, re-reading files that changed; pre/post hooks for databases and applications | | Follow-up backups | Unchanged files are taken over from the previous run; Windows reads changes from the USN journal; free space of NTFS and ext2/3/4 and zero areas are not stored; VMs on Hyper-V (RCT) and Proxmox VE (CBT) read only the areas changed since the last backup | | Deduplication | Content-defined (FastCDC), chunks of 256 KiB on average; across all backups of a store, also between computers and between file, disk and VM backups | | Chunk IDs | SHA-256, BLAKE3 (default for new stores) or XXH3-128; key-dependent with encryption | | Compression | zstd (also adaptive), lz4 or none, per chunk | | Backup chains | None: every version is complete and restorable on its own | | Interruptions | Resumption always on: after standby or a lost connection in the same run, after power-off or a crash at the next start; only what the destination lacks is sent. Held backups continue at the same point, from the moment of the first start: VMs keep their checkpoint or snapshots, finished disks, sections and files are not read again, on Windows even after a restart | | Ransomware warning | For file backups: an unusually high share of new, changed or deleted files compared with the last runs, or many typical extensions; the run is marked, a message goes out, older versions stay protected for 30 days by default | ## Store and protect | Destinations | Up to eight in one run: local or USB disk, NAS, your own backup server (also at a second site), AegisGrid cloud storage, S3-compatible object storage | | S3 object storage | Directly from the agent on Windows and Linux or as a copy of whole stores from the backup server; always encrypted; immutability through S3 Object Lock (governance or compliance); connection check before the first backup | | Encryption | AES-256-GCM or ChaCha20-Poly1305 per store, on the computer being backed up, before transfer; the key stays with the customer | | Transfer | TLS with a pinned server certificate, API keys per directory | | Immutability | WORM storage with a retention lock on the backup server, on S3 through Object Lock; the lock of single backups can be extended | | Retention | Per destination by days or by generations (daily, weekly, monthly, yearly) | | More copies | Mirroring whole stores to a second location or to S3, export of single backups as an archive for tape or USB disk | | Check and repair | Check of all stored objects (scrub), repair from a second copy, partial restore of damaged backups | ## Restore | Single files | Search by name across all versions, every version of a file, comparison of two versions; to the original location, to another folder or as a ZIP archive; ticked in the management console | | Version as a folder | Read-only on Windows (ProjFS) and Linux (FUSE), removed automatically when idle | | Files from disks and VMs | On Windows and Linux: provide a disk of a disk or VM run read-only, without restoring it; show volumes as folders, take files or a ZIP archive; Windows reads NTFS, ReFS, FAT and exFAT without an additional driver; in the management console with tick boxes | | Disks and VMs | Every version on its own, in parallel; VMs as a new VM or disk by disk, also straight from the backup server; restore in the background; restore wizard in the management console to the original or another disk, as a VHDX file (Windows) or as a new VM, with the destination checked first; Proxmox and Xen VMs also in place with an earlier version, the previous disks are kept until the restore has succeeded; optionally only differing blocks are written back; after a host has been set up anew, with the old VMID or name and the MAC addresses | | After the licence ends | Restoring from your own backup servers and destinations remains possible | ## Backup server and check restore | Backup server | Linux; privileged parts separated, data processing under its own unprivileged account; several customers separated, quotas per customer; hold backups and release them again, the computers continue by themselves after the release | | Jobs | On incoming backups, mirrorings and restores, by schedule and in flows; limits for CPU time, memory and disk access per job; usage measured per customer | | Check restore | Restore as a test; read-only file system check (ext2/3/4, XFS, Btrfs, vfat, NTFS, LVM in the image) per disk and partition; read every file with a checksum and compare with the last check; signs of ransomware (file type, entropy, extensions, ransom notes) | | Virus scan | ClamAV, read-only; a finding with the first affected and the last clean backup; signatures also for backup servers without internet access | | VM start | QEMU/KVM without a network or in an isolated network, dependent VMs in order; check by screen, guest agent or TCP port; report with traffic lights and screenshots | ## Operation, evidence and interfaces | Job scheduler | Linux and Windows service, parallel jobs, schedules as cron or RFC 5545 rule, public holidays per region, time windows, catching up on missed runs, jobs by hand only; pause with continuation at the same point, bandwidth limit; failed jobs retried (number and interval adjustable), a warning when a job has not succeeded for a set time | | Web interface | Built into job scheduler and backup server, over the same HTTPS API as the consoles; web users with the roles administrator and read only, every request signed, the password never leaves the browser; own certificate possible; five languages, light and dark, also on narrow screens | | Windows event log | Job scheduler and updates write service start, job and update results with fixed event IDs (source “AegisGrid”) | | Interfaces | Documented HTTPS APIs for job scheduler and backup server with roles for reading and managing; results by email | | Evidence | Log as JSON Lines with a SHA-256 chain, daily Ed25519 seal, copy by syslog (RFC 5424, UDP/TCP/TLS) or to a second backup server, export as CSV/JSON, signed monthly report as PDF | | Updates | Ed25519-signed, self-test before switching over, automatic return to the previous version on an error, staged rollout possible; running backups are held for the length of a job scheduler or backup server update and continued afterwards | | Languages | Programs, consoles, messages, emails and reports in English, German, Spanish, French and Croatian; every message with a fixed number | | Manual | Online manual in English and German with search; F1 in the consoles and the setup opens it at the matching section | | Provider | MSD Computersysteme GmbH, Germany; development and support in Germany | Terms such as deduplication, WORM or check restore are explained in the glossary (https://aegisgrid.de/en/glossary/). What has been added recently is listed under What's new in AegisGrid (https://aegisgrid.de/en/whats-new/). ## Does AegisGrid fit your environment? We check it with you on your own systems. Request a pilot project (https://aegisgrid.de/en/contact/?thema=pilot) --- Source: https://aegisgrid.de/en/whats-new/ What's new in AegisGrid # What is new In short: AegisGrid is under continuous development, and new features reach the computers with the signed updates. The most important ones are listed here by month – only what has already been delivered. Updated on 2026-11-13 ## November 2026 - **Web interface.** Job scheduler and backup server can be operated in the browser, without Windows and without additional software: jobs with wizard and schedule, runs, restores, storage and settings. Web users have the role administrator or read only; the password never leaves the browser. - **Fast follow-up backups for Proxmox VE.** For running VMs, QEMU keeps track of which areas the guest has written; the next backup reads only those. This saves time and storage load above all for large disks with few changes. - **Restore a VM in place.** A Proxmox or Xen VM gets back the disks of an earlier version and keeps its VMID or name. The previous disks are kept until the restore has succeeded; if wanted, only the changed blocks are written back. - **Host set up anew.** After a Proxmox or Xen host has been reinstalled, the VMs come back from the backup server with their old VMID or name and their MAC addresses. - **Files from drive and VM backups on Windows.** Single files and folders can also be taken from a disk or VM backup on Windows, without restoring the disk – with tick boxes in the management console or as a read-only folder. - **Back up files and folders.** Select folders and files in a tree, with permissions (NTFS, POSIX ACLs), on Windows with VSS and the change journal, on Linux with an LVM snapshot or while running. Deduplicated together with the disk and VM backups. - **Restore single files.** Search across all restore points, versions of a file, comparison of two restore points, restore to the original location, to another folder or as a ZIP. In the management console with check boxes. - **Open a restore point as a folder.** A backup appears as a read-only folder, on Windows and Linux, and can be browsed with the usual file manager. - **Ransomware warning.** If an unusually large number of files change in a file backup, the run is flagged, a notification is sent, and older restore points are not cleaned up for a set period. - **A deleted file in a few steps.** A list of all backups of the computer, a view of which destinations can be reached right now, and clear reasons when the search finds nothing. - **Virus scan in the check restore.** The backup server scans backups with ClamAV and states since which backup a finding exists and which one was last clean. - **Wizard for new jobs.** In the management console, new jobs are created in three steps: source, destinations, schedule – for drives, files and folders, and virtual machines. - **Virtual machines as a source.** The console reads the VMs from the hypervisor and points out VMs that no job backs up yet. - **Limits and usage per job.** On the backup server, CPU time, memory and disk access can be limited per job; usage is measured per customer. - **E-mail settings.** Recipients per type of notification, a daily summary e-mail, preview and test e-mail in the Target console. - **Pause, resume, throttle.** Running backups can be paused, resumed later and limited in bandwidth – from the console, the command line and the interface. - **Continue where the backup stood.** A held backup carries on at the same point instead of starting again: VMs under Hyper-V, Proxmox VE and Xen keep their checkpoint or snapshots, drive and file backups do not read what is finished again – on Windows even after a restart. - **Updates without broken-off backups.** During an update of the job scheduler or the backup server, running backups are held and exactly those are continued afterwards. When the backup server holds a backup, it carries on by itself once released. - **Jobs by hand only.** A switched-on job without a schedule runs only when someone starts it; a switched-off job does not start at all. Console and command line show both. - **Red Hat and SUSE.** AegisGrid also runs on Red Hat Enterprise Linux, AlmaLinux, Rocky Linux, SUSE Linux Enterprise Server and openSUSE Leap; setup and updates install missing system packages themselves if wanted. - **S3 object storage as a destination.** Backups go straight from the computer or as a copy from the backup server to S3-compatible object storage – always encrypted, immutable through S3 Object Lock if wanted, with a connection check before the first backup. - **Restore wizard.** The management console leads step by step through restoring a drive or a VM: to the original or another disk, as a VHDX file or as a new VM. The destination is checked first; an unsuitable one is refused with the reason. - **Retry and warn.** The job scheduler starts failed jobs again after a pause. If a job has not succeeded for a set time, the console and an email warn about it. - **Xen with memory.** Running Xen VMs can be backed up including their memory; after the restore, the VM carries on where it stood. - **Online manual.** The manual is available in English and German at aegisgrid.de/handbuch/en (https://aegisgrid.de/handbuch/en/), with search. F1 in the consoles and the setup opens it at the matching section. - **Guided first start.** After installation, the setup leads straight to the first backup, and after the first successful run the console suggests a test restore. - **Windows event log.** The job scheduler and updates write their results with fixed event IDs to the application log – for existing monitoring systems. - **More progress in the target console.** Besides backups, it also shows running restores, Microsoft 365 backups and mirrorings with their progress. - **Security review.** The program was systematically reviewed for weaknesses and hardened further, among other things with TLS 1.2 or later between computers and backup server and current libraries. ## October 2026 - **Five languages.** Programs, consoles, messages, e-mails and reports in German, English, Spanish, French and Croatian. - **Check restore.** Backups are restored as a test on the backup server, file systems are checked, every file is read and VMs are started in an isolated environment; with a check report including traffic lights and screenshots. - **Evidence for auditors.** A chained log signed daily, a copy to a SIEM and a signed monthly report. - **Extended schedules.** Public holidays per German state, time windows, catching up on missed runs and the schedule in plain words. - **Faster chunk IDs.** New stores use BLAKE3; existing stores keep their method. All features at a glance are listed under Features (https://aegisgrid.de/en/features/), the details under Specifications (https://aegisgrid.de/en/specifications/). ## Curious? We will show you the new features on your own systems. Request a pilot project (https://aegisgrid.de/en/contact/?thema=pilot)