The immutable, isolated copy as a service: cloud storage managed by Commvault, retention lock and total separation from your domain — the turnkey vault.
The isolated copy is the piece that saves you when everything else is compromised — but building it well takes a project. Air Gap Protect offers it as a service: object storage operated by Commvault (on Azure/OCI), immutable with retention lock, outside your tenant and your credentials. You enable it from the console, pay as you consume, sleep better.
Tenant, keys and billing outside your perimeter: the insider can't reach it.
You pay per protected TB: the vault grows and shrinks with the data.
Dedup and incrementals: the off-site doesn't saturate the WAN.
Certifiable immutability for NIS2/DORA: the evidence is in the service.
Isolation is threefold: network (data travels encrypted to the service's endpoints, not to storage in your tenant), credentials (access goes through the platform with MFA, not via your cloud keys that an attacker could steal) and administrative (retention lock: not even a support ticket deletes before expiry); recovery is a normal restore from the console — the air is crossed only in read mode and only authenticated.
The copy the attack can't reach.
The air gap without the enterprise project.
Demonstrable immutability, right away.