About Vaults
This article explains the basics of vaults and how they work in Eon.
A vault is a cloud storage destination where your Eon snapshots are saved. The vault resides in a vault account in your dedicated Eon tenant, which is logically air-gapped from your other environments.
When you create a vault, you choose the cloud provider and region you want the vault to be created in. Each vault account is dedicated to a single customer, so no other Eon customer data can be stored in your vault.
Vaults are closely related to backup policies. When you create a backup policy, you specify a vault to store the snapshots in. See About Backup Policies to learn more about how backup policies and vaults work together.
The first time a resource is backed up to a given vault, a full snapshot is taken. Later snapshots of the same resource in the same vault are incremental.
Vault encryption
All data stored in your Eon vaults is encrypted with an encryption key.
For AWS or GCP vaults, you can choose between using an Eon-managed encryption key or a customer-managed KMS key. The Eon-managed key is recommended and provides several advantages, including air-gapped security and automatic rotation. See About Self-Managed Vault Keys to learn about using your own encryption key.
For vaults in other cloud providers, only the Eon-managed key is currently supported.