Protecting and Recovering Your Critical SAAS Workloads with KeepIt

[00:00:05] Paul O’Dell and Paul Robichaux — Introductions:
Paul O’Dell: Hello, everybody. Paul O’Dell here from CPP. Paul, would you introduce yourself? Paul Robichaux: I’m Paul Robichaux from Keepit. I’m currently in Vienna, although that’s not where I’m normally based. It’s the Paul and Paul show from across the world. We’ll give everyone another minute to join before we get started.

[00:01:44] Paul O’Dell, CPP Associates:
Thank you for joining. We’re excited to get this webinar started and discuss protecting and recovering your critical SaaS workloads. I want to thank Paul from Keepit, acknowledge our partnership with Keepit, and thank everyone attending today.

[00:02:10] Paul O’Dell, CPP Associates:
A housekeeping note: we had over 500 registrations, including a couple of hundred that appear not to be real people. We’ll send the Uber Eats gift cards after the call so they go to the people who actually attended. Sorry for any miscommunication; we couldn’t find a way to keep the automated registrations from getting cards. The AirPods will also be sent afterward. Before I hand over to Paul, I want to give you some background on CPP and what we’re seeing at a high level.

[00:03:04] Paul O’Dell, CPP Associates:
We have over 150 customers and hundreds of prospects. I would say 99% of my day-to-day client discussions focus on four things. First, optimizing cloud workloads. Whether workloads are moving to the cloud, to a SaaS application, or from the cloud back on premises, CPP helps people determine where those workloads should reside.

[00:03:32] Paul O’Dell, CPP Associates:
Next is AI. You can hardly walk down the street without hearing about it. The world is recognizing that AI is important, but so is implementing it securely, with governance, and delivering something more useful to the business than a glorified search engine. CPP has a whole team focused on that.

[00:03:59] Paul O’Dell, CPP Associates:
You can do great things with AI and cloud optimization, but without a good recovery and security strategy, it doesn’t mean much. Today we’ll discuss how to recover and protect critical workloads. Security is important, but the vast majority of ransomware attacks happen to organizations that already have firewalls, endpoint protection, and other security measures. You need to think about how to recover after an incident as well as how to keep attackers out.

[00:04:45] Paul O’Dell, CPP Associates:
Many of you know CPP, but if you don’t, we’ve been around for a while. This is our awards slide. It stops at 2024, but we received similar recognition in 2025.

[00:05:04] Paul O’Dell, CPP Associates:
We keep our offerings simple. We have three service delivery models: fully managed, co-managed, and project-based statements of work. In a co-managed arrangement, the customer manages part of the environment and we manage the rest. For a project, we can implement the solution, write the runbook, and hand it over. We’re comfortable with any of those models. We want happy, repeat customers.

[00:05:40] Paul O’Dell, CPP Associates:
A primary difference is that we’re an engineering-heavy company. Many competitors have 30 or 40 sales representatives for every engineer. We have more than two engineers for every sales representative. That lets us make investments, get into the technical details, and help projects succeed.

[00:06:05] Paul O’Dell, CPP Associates:
These are quotes about why customers work with CPP. The middle one is important: in an overly complicated world, having an organization that helps you cut through red tape, get things done, and make decisions quickly matters. I think we do that well.

[00:06:37] Paul O’Dell, CPP Associates:
I’m a history enthusiast, and the Battle of Marathon has always stood out to me. The Greeks were severely outnumbered but won because they could play offense and defense at the same time. Think of offense as AI, cloud optimization, transformation, and doing more with SaaS workloads. If you can’t also play defense, you have exposed weaknesses and potentially a business that can’t recover. Protecting the business while moving it forward is critical. Today we’re discussing one half of that strategy. Thank you for listening. I’ll monitor the chat, and Paul, I’ll hand it over to you.

[00:07:44] Paul O’Dell and Paul Robichaux — Presenter handoff:
Paul Robichaux: Thank you, other Paul. We’ve been discussing who is Paul and who is “other Paul.” I have a slide deck to go through, and I tend to talk fast. Paul O’Dell: You’re a presenter now. Paul Robichaux: Great. Let me turn off captions and share my slides. Can you see them? Paul O’Dell: I can see the slides.

[00:08:34] Paul Robichaux, Keepit:
I like to start with an introduction to Keepit and myself. I’m Paul Robichaux, Senior Director of Product Management at Keepit. I work on the product team, talking to customers, showing them the product, and gathering feedback. I’m normally based in Alabama. I’m in Vienna today because I was meeting with a large bank about what we’re doing, including our AI implementation strategy, and getting their feedback.

[00:09:09] Paul Robichaux, Keepit:
Keepit isn’t very well known. Nine times out of ten, when I talk to new customers at events such as Gartner IOCS, Gartner Symposium, or Microsoft Ignite, people say, “I’ve never heard of Keepit. What do you do?” I like to explain where we came from, what we do, and why it’s different.

[00:09:37] Paul Robichaux, Keepit:
Keepit was founded in 2016. Our two cofounders, based in Copenhagen, Denmark, started a hosting company while they were at university. They made money and were smart enough to sell it. They saw a trend toward everyone getting software from the cloud. That wasn’t obvious in 2016, but they turned out to be right. Their hosting experience informed what we built, as I’ll explain later.

[00:10:17] Paul Robichaux, Keepit:
The first thing to understand about enterprise software as a service is shared responsibility. Whether you know it or your vendor has made it clear, we all share responsibility with our SaaS vendors. Microsoft is explicit about this. Salesforce is less explicit, and some other vendors are unclear.

[00:10:51] Paul Robichaux, Keepit:
A SaaS operator such as Zendesk, Salesforce, Miro, or Microsoft takes responsibility for the platform the application runs on. For Microsoft 365, that includes the network, data center, fire suppression, and operating system patching. Those are Microsoft’s responsibilities. The vendor also maintains the applications. If you use Google Workspace, Google is promising that Gmail, Sheets, and Drive will work, even though applications sometimes have outages.

[00:11:39] Paul Robichaux, Keepit:
As we move across this diagram, the responsibilities of administrators and customers begin to come in. You and your SaaS vendor share responsibility for the directory. You tell the application which users are authorized and what they can do; the application supplies the framework for those permissions. Devices accessing the application are your responsibility. You also own and are responsible for the application’s data and associated identities.

[00:12:29] Paul Robichaux, Keepit:
That may sound strange because most people assume their SaaS vendor protects the data in the application. It does, but perhaps not in the way you expect. Essentially, the vendor promises not to lose all your data at the same time. Microsoft promises not to lose all your email irrecoverably. It isn’t promising never to lose any of it or to recover it when the loss results from something you did or didn’t do. That distinction is critical.

[00:13:18] Paul Robichaux, Keepit:
A large SaaS vendor may tell you it has backup and restore. But suppose you have 500,000 Salesforce opportunity records and a bad automation accidentally deletes them. If you ask Salesforce to recover those records, it may say it can restore the entire environment but not that segment of data. That’s shared responsibility: the vendor restores the building, but the furniture, bedding, and family photographs are your responsibility.

[00:14:04] Paul Robichaux, Keepit:
Once you understand shared responsibility, the next question is whether you need to worry about your data. We’re all responsible for things we don’t think about daily. The data on this slide comes from research organizations such as Gartner, ESG, Forrester, and Proofpoint. We’ve selected the points we consider most important.

[00:14:35] Paul Robichaux, Keepit:
First, 99% of human-operated attacks target backups and backup products. If your backups run on premises or are stored in the same tenant or service as production data, they’re at risk. Eighty percent of companies that pay a ransom get hit again. We like to think that getting struck by lightning once means it won’t happen again, but continuing to expose yourself to the same risk makes another attack possible. Eighty-four percent of companies attacked by ransomware reported some data loss.

[00:15:22] Paul Robichaux, Keepit:
More than 70% of companies have had data loss incidents caused by a user mistake. I don’t like the slide’s wording about “careless users.” Sometimes a user makes a mistake or has permission to do something without understanding the consequences. We see this with administrators writing scripts, Power Automate automations, or Zendesk workflows. It’s possible to get a bad outcome despite good intentions.

[00:16:03] Paul Robichaux, Keepit:
I won’t spend much time on compliance, but it deserves a mention. Almost regardless of where you are or what business you operate, you probably have compliance responsibilities you don’t think about regularly. My enterprise customers tend to have 10,000 seats or more and operate globally or across several countries. Those organizations are regulated, but compliance isn’t only a European issue. Doing business in Europe can bring obligations, and California has its own requirements.

[00:16:56] Paul Robichaux, Keepit:
Organizations in financial services, life sciences, pharmaceuticals, and transportation may already be aware of requirements involving the Cybersecurity and Infrastructure Security Agency. It’s worth asking whether you have compliance obligations that aren’t being addressed. CPP can help identify your requirements, then work with Keepit to determine how backup, recovery, disaster recovery, and business continuity fit those needs.

[00:17:38] Paul Robichaux, Keepit:
We use a lot of puns with the Keepit name: “Keepit future-proof,” “Keepit real,” and so on. Today we support 16 workloads. We shipped GitHub support this week, which isn’t on the slide yet. We cover many of the critical SaaS workloads companies use, including Microsoft 365, Google Workspace, Confluence, and Salesforce. Those applications represent hundreds of millions of seats. Our architecture lets us add new workloads fairly quickly.

[00:18:39] Paul Robichaux, Keepit:
The 2007 date on this slide refers to when our founders started their hosting company—the entity that eventually became Keepit. We have certifications, which matter in certain markets. The map shows our supported regions. Our US headquarters is in Dallas, and we have seven data center regions worldwide. We’re adding an eighth in South America and expect two more later this summer that I can’t disclose yet.

[00:19:20] Paul Robichaux, Keepit:
One of Keepit’s biggest differences is its completely independent cloud. We host our services in Equinix data centers. Our experience in hosting—including a Copenhagen data center flooding in 2009—taught us to leave hosting to professional providers. We rent space from Equinix, but own the rest of the infrastructure: storage, operating system, object store, file system, and web server. Those are things we built.

[00:20:12] Paul Robichaux, Keepit:
We have no dependencies on hyperscalers: no components or services in Azure, AWS, GCP, or Cloudflare. We own and control the whole stack. We built it specifically for backing up SaaS applications. It isn’t as flexible as S3 or Azure Blob Storage, but it isn’t intended for those purposes. If you’re building a Lego Death Star, you want the pieces designed for that model, rather than only generic square blocks. We took the same approach to our stack.

[00:21:14] Paul Robichaux, Keepit:
Another advantage of independence is that an attacker can’t put the data at risk in the same way as backups held in a public hyperscaler. In a room, I’ll ask who uses Azure or AWS for backups, then who has hybrid connectivity to that cloud. Usually, everyone keeps their hand up. Hybrid connectivity is useful and convenient, but it can also give an attacker a route between environments.

[00:22:01] Paul Robichaux, Keepit:
Microsoft’s 2025 Digital Defense Report said hybrid attacks increased 84% year over year. In these attacks, someone compromises the cloud and pivots on premises, or compromises an on-premises environment and pivots to the cloud to destroy backups. I recommend reading that annual report; it contains a lot of useful information.

[00:22:42] Paul Robichaux, Keepit:
Complicated attacks might start with a compromised mobile device, move into the on-premises environment, then into the cloud. Those techniques once belonged mainly to nation-state attackers. They then became available to criminal organizations and ransomware groups. The next step is for smaller, less well-funded criminals to use the same tools. We’ve seen that pattern repeatedly: advanced capabilities eventually become accessible to far less sophisticated attackers.

[00:23:36] Paul Robichaux, Keepit:
Because we own the infrastructure, we don’t charge based on storage utilization. We don’t care how much data you have or how long you want to retain it. We count users and charge a per-seat price. With the competitor model shown here, you pay for seat licenses and a storage allowance, then pay more as storage utilization increases. Those providers have underlying storage costs to pay.

[00:24:48] Paul Robichaux, Keepit:
Suppose you buy 1,000 seats with an additional charge if you exceed a storage limit. A year passes, and data usage grows. Storage utilization rarely goes down. That puts you on an escalator: each year, you pay for more storage because users have more data. That’s what the blue line on the chart represents.

[00:25:30] Paul Robichaux, Keepit:
With Keepit, there are no ingress or egress charges, storage utilization charges, or extra fees for longer retention. When someone leaves your organization, we retain their data without charging you twice. If you have 1,000 employees and replace someone who leaves, we begin backing up the replacement. You now have 1,001 users’ worth of data but still pay for 1,000 seats.

[00:26:05] Paul Robichaux, Keepit:
We’ve won awards for usability, and you can look at reviews on Trustpilot, TrustRadius, or G2. Ease of use is intentional. We started by building products for small companies without dedicated IT teams. As we’ve grown to larger organizations—our largest single customer has more than 250,000 seats—that usability still matters. Large customers also want to avoid spending time searching for controls or figuring out what moved in a new release.

[00:27:13] Paul Robichaux, Keepit:
There’s one platform for all the SaaS applications we back up: Microsoft 365, Entra, Power Platform, Google Workspace, Salesforce, and others. The interface, reporting, visibility, alerting, and auditing work consistently. The more SaaS data you protect, the more valuable it is to manage it all from one place.

[00:27:48] Paul Robichaux, Keepit:
We’re Danish, with an active US business. I’ve tried to get the marketing team to adopt this line: our product is private enough for Europe and tough enough for the United States. As a European company, we must follow stringent data protection laws, including GDPR and other European privacy requirements.

[00:28:45] Paul Robichaux, Keepit:
We intentionally built an architecture where data placed in a region stays there. If you put data in our US East region, it won’t move to Canada, Australia, or the EU. The same applies in reverse for EU regions. That lets us give regulators, auditors, and risk or compliance committees strong assurances about what will happen with customer data. Customers want certainty and sovereignty over their data.

[00:29:41] Paul Robichaux, Keepit:
Because of the architecture, data stays within the region. We maintain multiple copies across distributed data centers within that region. The important point on this slide is “immutable by design.”

[00:30:12] Paul Robichaux, Keepit:
Normally, immutability is a configuration option. You might go into a storage interface, select a setting to make data immutable, and assume you’re protected. But remember the risks of hybrid attacks and well-meaning people clicking something they shouldn’t. Immutability by design offers protection that a configuration option alone does not.

[00:31:05] Paul Robichaux, Keepit:
We can do this because we control the file system and object store. Our file system has two operations: read a block and write a block. At the block management level, there is no operation to modify or delete a block. If you offered me a million dollars to change blocks in your backup, I couldn’t do it through those operations.

[00:31:43] Paul Robichaux, Keepit:
You could imagine physically breaking into the data center, getting past the guards, locating the right server and disk, and using a Linux tool such as dd to change a block. But we use a specific implementation of blockchain called a Merkle tree to protect the data. We can add a new block to the tree, but there isn’t a way through that structure to modify an upstream block.

[00:32:29] Paul Robichaux, Keepit:
Here’s how that works in practice. On day zero, there’s a hash at the root of the tree, with hashes for files such as notes.docx and a budget file. Each has a unique hash recorded in the structure. We can read from the beginning of the tree down to the relevant data.

[00:33:12] Paul Robichaux, Keepit:
One architectural detail I haven’t mentioned is that we use spinning disks. People sometimes react skeptically, but disks are inexpensive and widely available. Put enough of them together and you get tremendous I/O throughput. Adding something to the end of a tree is essentially sequential I/O, which disk arrays handle quickly. Reading a tree means moving between blocks, and striping the data across many disks gives us strong random I/O throughput too.

[00:34:15] Paul Robichaux, Keepit:
We get strong performance from inexpensive redundant disks, similar to the principles behind RAID but at a much larger scale. On day one, if the notes file changes, we calculate a new hash and add another node. To restore the day-zero version, we read the earlier hash; to read the current version, we use the new one.

[00:34:48] Paul Robichaux, Keepit:
Notice that the hash at the root also changes. If someone physically altered blocks on disk, the next read would fail verification and reveal the tampering. An attacker with physical server access couldn’t modify the data in a useful way. As data changes, the tree grows new blocks. Every read and write includes cryptographic verification to detect tampering.

[00:35:32] Paul Robichaux, Keepit:
We built this architecture to manage data from cloud applications. About 20 years ago, some teams at Microsoft explored using SQL as the data store for Exchange because of SQL’s performance, redundancy, and data protection features. That didn’t work well because SQL expects structured tables with consistent columns, while Exchange metadata behaves more like a bag of properties. One message might have three properties and another 25.

[00:36:29] Paul Robichaux, Keepit:
Carry that forward to Exchange, SharePoint, OneDrive, and Teams, then add Salesforce and Okta. You have many formats, data types, and amounts of data. We handle those natively instead of trying to fit them into a general-purpose Azure Blob or Cosmos DB structure. Some products take an on-premises design, host it in the cloud, and call it cloud-native, even though they retain the same storage layout and technologies. Those aren’t always a good fit.

[00:37:31] Paul Robichaux, Keepit:
Supporting many applications is useful, but the important question is how well you can protect them compared with another backup product or relying only on the application vendor. One feature I’d show early in a demo is independent access. When AWS or Microsoft has an outage, you can still log in to Keepit to preview, download, and share your backed-up data.

[00:38:08] Paul Robichaux, Keepit:
We have a separate sharing mechanism. I can create a link covering an entire SharePoint estate or drill down to one email in a mailbox. Links can use password protection, SSO, expiration times, or restrictions to a specific IP range. Administrators can access the data during an outage and can also give users access to their own data.

[00:39:02] Paul Robichaux, Keepit:
That means users can access backed-up SharePoint data while SharePoint Online is down. If Entra or its MFA service is unavailable, I can give an individual access to her own data through Keepit so she can download a presentation and keep working. Local OneDrive synchronization or Outlook OST files are useful, but they don’t help if the user needs something that wasn’t synced before the service went down.

[00:39:51] Paul Robichaux, Keepit:
We offer several restore options. This week, we rolled out a version in the US that supports cross-tenant restore for Entra. We can back up users, policies, groups, application registrations, and other protected objects, then restore to the original tenant or another tenant. We can also back up a SharePoint site and restore it to a different URL in the same tenant or to a different tenant.

[00:40:33] Paul Robichaux, Keepit:
The goal is to get the right data to the right people, in the right place, at the right time. We obviously can’t restore into a Microsoft service while that service is down. That’s why I discuss access before restore. Even when Microsoft is unavailable, you can still get your backed-up data. Once Microsoft can accept restore requests, we can help put it back.

[00:41:07] Paul Robichaux, Keepit:
Analytics address familiar questions: what’s being backed up, when was it last backed up, is anything missing, and is anything unusual? Our AI-powered anomaly detection identifies changes in backup data volume. One common trigger is an accidental configuration change that excludes data and makes the backup smaller.

[00:41:56] Paul Robichaux, Keepit:
Another trigger is a large increase in files or file versions. A ransomware attacker encrypting OneDrive or SharePoint content creates many changes, which we can detect. You may already have XDR, SIEM, and other security tools intended to prevent or remediate attacks. People sometimes ask what value there is in detecting an anomaly when the backup runs.

[00:42:39] Paul Robichaux, Keepit:
Additional detection can catch changes that other security layers missed. That’s part of defense in depth. Detecting the anomaly also marks a point in time and helps identify the backup before it—the recovery point to investigate as the last known good backup.

[00:43:06] Paul Robichaux, Keepit:
We’ll send the slides so you can review this comparison chart in more detail. When evaluating protection options, consider cost, compliance, recovery capability, ease of management, and security commitments. We believe Keepit compares well, but you don’t have to take my word for it. You can look up the awards and supporting information.

[00:43:45] Paul Robichaux, Keepit:
This customer list looks European-heavy because many large US customers don’t let us name them publicly. One that does is Quanta Services, a large energy infrastructure company. If you see a utility worker repairing a pole, that worker may be using equipment associated with Quanta. We have other comparable customers that don’t permit public references. You can see some customers on our website, and if you explore the product with CPP, they can share more under an NDA. I’ll stop there, Paul.

[00:45:01] Paul O’Dell, CPP Associates:
Thank you, Paul. CPP also has customers who can provide references, and we can make those connections if you reach out. I prepared a few poll questions while people think about what else they’d like to ask. The first is: who is responsible for backing up data in most SaaS applications? The options are the Candyman, the SaaS vendor, the client or user, and the Cloud People of Peru. We’re being a little tongue-in-cheek, but please put in a vote.

[00:45:58] Paul O’Dell, CPP Associates:
Thank you. You’ve got it: the client, as Paul explained earlier. Thanks, Justin, for the reaction. Let’s move to the next poll: which SaaS platforms are you most concerned about protecting today? It looks as though many people have multiple platforms, including Microsoft 365. I’ll share the results.

[00:46:58] Paul O’Dell and Paul Robichaux — Poll results:
Paul O’Dell: Can you see the results, Paul? Paul Robichaux: Yes, I can. Paul O’Dell: Any questions while I’m doing this? The next poll asks: how would you describe your current SaaS data protection?

[00:47:25] Paul Robichaux, Keepit:
That’s a good question. I’m interested to see the breakdown. One of the things I hear most often when speaking with enterprises—even organizations with 50,000, 75,000, or 100,000 seats—is that they don’t have a disaster recovery plan. They buy a backup tool thinking that will be enough. A tool is one component of data protection and resilience, but it isn’t everything you need. If you’re among the 45% of respondents relying only on what the SaaS vendor provides, there’s work to do.

[00:48:05] Paul O’Dell and Paul Robichaux — Poll discussion:
Paul O’Dell: That’s not uncommon in the market. Paul Robichaux: It’s very common. Paul O’Dell: I’ll share the results. Thank you to everyone voting. We have two more questions, and we’ll send the Uber Eats cards later to attendees who participated. Next: what’s your biggest driver for improving SaaS backup and recovery?

[00:48:57] Paul O’Dell, CPP Associates:
Thank you for voting. I’ll share the results. Ransomware is number one. While researching these questions, I found the merger-and-acquisition use case interesting. It wasn’t one I had initially considered.

[00:49:29] Paul Robichaux, Keepit:
M&A is surprisingly underrated. I used to run migration workloads at Quest, a major company in that space. I always told people to back up before starting a migration and after finishing. That’s especially important in a divestiture, when you’re spinning off part of the company.

[00:49:52] Paul Robichaux, Keepit:
I’ve seen cases where part of a company was sold or closed, and later the buyer said critical information was missing—something like the secret formula or an important recipe. Being able to say, “I have it right here,” can save you. With large deals, people can be very aggressive about missing information, so it’s important to protect yourself.

[00:50:26] Paul O’Dell, CPP Associates:
The final poll is a repeat, so that’s the end of the questions. If anyone has another question, put it in the chat. There’s no pressure. Thank you to everyone who joined and participated. You’ll receive a copy of the presentation, and CPP and Keepit are here to help. We’re happy to answer questions. There’s no pressure for a sale; our goal is to make this educational.

[00:51:17] Paul O’Dell and Paul Robichaux — Closing:
Paul O’Dell: Paul, thank you. I know it’s late in the day where you are. Paul Robichaux: It was a pleasure. Thanks for having me. Paul O’Dell: Have a good day, everybody. Paul Robichaux: Enjoy your Thursday. Thanks, everyone.