Frequently
Asked Questions.

Your data is encrypted on your own device using AES-256-GCM before any of it is transmitted. File names, folder structures and file contents are all encrypted — what travels the wire and what is written to storage is ciphertext.

The key used for that encryption is your Vault Key, which is held in your EndLock Vault account so that access to your backups is never lost if you forget it. Because it is recoverable through your account, the security of your account and of the email address used for password resets is what protects your backups — we strongly recommend enabling two-factor authentication on both.

Nothing is lost. You can view your Vault Key at any time from your client portal, or change it from Manage Vault — Change Vault Key. Changing it does not affect your existing backups, which remain fully restorable. If you cannot sign in to the portal, reset your account password using the link on the login page.

This is a deliberate design choice: with many backup products, a forgotten key means permanently losing your data. With EndLock Vault it does not. We still recommend storing your credentials in a password manager, and enabling two-factor authentication on your account.

Object lock (also known as WORM — Write Once Read Many) is a storage feature that makes data immutable for a defined period. Once your data is written to the vault, it cannot be modified, overwritten or deleted by anyone — including ransomware, an attacker holding your credentials, or EndLock Vault itself.

This is what separates EndLock Vault from a standard cloud sync or backup. Where deletion is prevented only by permissions, an attacker who obtains your credentials can remove your backups. With object lock, the storage layer itself refuses — for the full 30-day retention period, regardless of what happens to your live systems.

Yes, twice over. Your data is encrypted on your device with AES-256 before it leaves, and that already-encrypted data is then transmitted over a TLS-secured connection directly to your vault region.

Anyone intercepting the connection would find encrypted data that is meaningless without your Vault Key.

Cloud sync services keep a live copy of your files in step with your device. That is genuinely useful, but it is not backup, and the difference shows under attack.

Immutability: If ransomware encrypts a file on your device, a sync service uploads the encrypted version and replaces the good copy. EndLock Vault's object lock means a stored backup cannot be altered or deleted at all.

Data residency: Sync services generally store data wherever their infrastructure happens to be. EndLock Vault keeps your data in the region you choose.

Purpose: Sync is built for sharing and availability across devices. EndLock Vault is built for one thing — getting your data back after something goes badly wrong.

Yes. The number of devices included depends on your plan tier — Personal plans cover 1 device, and Business plans are available with 2, 3 or 5 devices. See the pricing page for the current tiers.

All devices on a plan share the same vault and the same Vault Key. That means any device on the plan can restore data backed up by another — useful when replacing a machine, and worth knowing if different people use the devices. If you need separation between users, use separate plans.

An Additional Vault is a second independently immutable vault in a different region from your primary one. If your primary vault is in AU Sydney, for example, you could add a second in EU Frankfurt.

It is provisioned empty, and you decide what goes into it from your backup agent — a mirror of your primary backup for true geo-redundancy, a different machine, or a separate archive. Setting up a schedule pointing at it takes a couple of minutes.

It is available on all plans, billed independently, and can be added at any time from your client portal.

All Personal and Business plans include a 30-day retention policy, so you can restore from any point within the last 30 days.

Because backups are written under object lock, data within that window cannot be deleted early — by you or by us. That is the protection working as intended, and it also means storage space is not released the moment you remove something.

Enterprise clients can arrange custom retention periods as part of their agreement.

You can cancel immediately, or at the end of your billing period. Either way your vault is decommissioned and you lose access to it — so restore or export anything you want to keep before cancelling.

Because backups are written under object lock, stored data cannot be erased on demand. After decommissioning it remains encrypted and inaccessible until its retention period expires, and is then permanently purged. Reinstating a subscription later provisions a new, empty vault — data from a cancelled vault is not recoverable.

See our Billing Policy for full details.

After subscribing, your vault is provisioned automatically and you can sign in to your client portal straight away. From there:

1. Open Vault Key and copy it — you will need it in step 4.
2. Click Download Agent and choose your operating system (Windows, macOS or Linux).
3. Run the installer — it takes under 2 minutes.
4. Sign in to the agent using your email address as the username and your Vault Key as the password — not your account password.
5. Give the device a name, and your first backup begins on the built-in schedule.

No technical expertise is required, and you do not need to enter a server address — it is already configured in the version you download.

The EndLock Vault agent supports Windows, macOS (Intel and Apple Silicon) and Linux on Personal and Business plans.

Enterprise plans additionally cover Windows Server, Linux server environments, and virtual machine platforms including Microsoft Hyper-V, VMware vSphere and Proxmox. Database backup for Microsoft SQL Server, MySQL and MongoDB is also available on Enterprise.

Two ways, and you can use either:

From the agent — on any device on your plan. Browse your backup history and restore the files or folders you need from any point in your 30-day window.
From the web portal — sign in from any browser with your email address and Vault Key. Nothing to install, which makes it the quickest route if the original machine is lost, stolen or broken.

Disk image and bare metal recovery are available on Enterprise plans with image backup enabled.

We recommend a test restore every 90 days so you know your backups are recoverable before you need them.

The agent is designed to be lightweight. After the initial full backup, subsequent backups are incremental — only new or changed data is uploaded, which reduces ongoing bandwidth use considerably.

You can set backup schedules to run outside working hours, and apply bandwidth limits within the agent so backups never compete with your normal work.

Revoke its access first. From your client portal, open Manage Vault, find the device under Registered Devices, and click Revoke. That frees the slot and stops the device backing up.

Your backup data is unaffected — revoking a device removes its access, nothing more. Install the agent on your replacement machine, sign in with the same email address and Vault Key, and your full backup history is there to restore from. You can also restore straight away from the web portal without installing anything.

If you are concerned the device's stored credentials may be misused, change your Vault Key from the portal as well. Existing backups remain restorable after a change.

Your plan's device slots are all in use. Open Manage Vault in your client portal, find Registered Devices, and revoke one you no longer need — an old, lost or replaced machine.

If you regularly need more, upgrade to a plan with more device slots from your client portal.

Yes. The agent automatically excludes files that are pointless or problematic to back up — temporary files, operating system page files, browser cache, recycle bin contents and application data that can simply be reinstalled.

You can manage exclusions yourself within the agent, either to include something that is being skipped or to reduce backup size. If you are unsure whether a particular path is covered, contact us and we will check.

No. The price shown at checkout is what you pay. Backup software and per-device licences are included in every plan — no separate licensing costs, no per-GB fees, and no egress or download fees when you restore.

The only addition would be an Additional Vault, which is optional and priced separately. Applicable taxes are shown at checkout before you confirm. See the pricing page for the full breakdown.

Upgrades: you are invoiced for the price difference, prorated for the rest of your billing cycle. Your vault is resized once paid, without affecting your existing backups.

Downgrades: these take effect immediately with no charge and no credit for the remainder of the cycle. Your new rate applies from your next billing date.

Before downgrading, check two things: your registered devices must fit the new plan's device limit, and the data already in your vault must fit the new storage allocation. Because backups are held under object lock, space is not released until retention expires — so a plan smaller than your current usage will not be available to select.

We support billing in USD, CAD, EUR, GBP, AUD, SGD and ZAR. You select your currency during checkout and it is fixed to your account from that point, so your monthly amount stays consistent.

All prices are shown in USD as the base currency, with the amount in your selected currency displayed before you confirm your order.

You get email reminders on day 1 and day 3, and your vault carries on working normally — backups continue and restores are available.

On day 7 the service is suspended and a 10% late fee is applied. Suspension stops backups and restores — the agent will sign out and report the account as suspended. Your data is not deleted; it stays in your vault, encrypted and intact. We retry your saved card automatically on days 7 and 14.

A final notice goes out on day 14. On day 30 the account is terminated and the vault decommissioned.

Resolving payment at any point restores access immediately. Keeping a current card on file in your portal is the simplest way to avoid all of this.

From Payment Methods in your client portal. You can add a new card, set which card is used by default, or remove one you no longer need.

Your card is stored securely by our payment provider — we never see or hold your card details. If a card on your account expires, we will use another valid card where one is available, so keeping a spare on file is worthwhile.

Your backup data is stored exclusively in the vault region you select at signup. We operate 10 regions: AU Sydney, CA Toronto, EU Frankfurt, EU London, EU Paris, JP Osaka, JP Tokyo, SG Singapore, US Oregon and US Virginia.

Once you select a region, your data stays there. It is not replicated to other regions, not processed outside that jurisdiction and not moved for any operational reason.

Your account data — name, email and billing records — is held separately from your backup data, which is distinct from the region you choose for backups. Our Privacy Statement sets out exactly what we hold.

Yes — that is precisely why we offer specific regions rather than a generic cloud. If your organisation needs backups held within the EU, the UK, Canada, Australia, Japan, Singapore or the United States, you can select that region at signup and your data stays there.

We can confirm your vault region in writing, describe our encryption and storage architecture, and provide a Data Processing Agreement where one is required. What we cannot do is tell you whether your particular obligations are met — that depends on your circumstances, and your own advisers are better placed to judge it.

Yes. We can supply written confirmation of your vault region and data residency, details of our encryption standards and storage architecture, and a signed Data Processing Agreement where required.

Contact us with what your auditors need and we will put it together.