Blog

Launch announcement — Version 1.0.0 GA — May 20, 2026

Author: Heitor Faria · Website: https://podheitor.com · Email: heitor@opentechs.lat · Phone / WhatsApp: +1 786 726-1749 | +55 61 98268-4220

Summary

The PodHeitor Microsoft 365 Backup Plugin reaches general availability at version 1.0.0. It is a 100% native Rust component of the PodHeitor Backup Server stack, performing full backup of Microsoft 365 tenants — Exchange Online, OneDrive for Business, SharePoint, and Teams — with an optional continuous data capture (CDC) window down to 60-second RPO.

The focus of v1.0 is capture: consistent, efficient, auditable extraction of M365 data. The current restore interface covers extraction to local filesystem (PST/EML/JSON/raw payload). Direct write-back restore to the Microsoft 365 tenant via the Graph API is documented on the v1.1 roadmap — it is not delivered yet.

Positioning

PodHeitor is an independent backup system written in Rust. The M365 Backup Plugin is a component of the PodHeitor Backup Server and can also be consumed as a plugin for Bacula Community 15.0.3 via the same native plugin API — but the product sold, supported, and roadmapped is the PodHeitor stack.

v1.0.0 GA scope

Headline numbers

Relevant architectural decisions

• Memory-safe without GC. Backend is Rust 1.x with unsafe_op_in_unsafe_fn = warn and clippy pedantic + restriction enforced as CI gates. No JVM or managed runtime consuming RAM in parallel with the backup job.
• Simple HTTP client. Synchronous ureq with rustls + ring. No tokio. Throughput against the Graph API is limited by tenant throttling, not the client.
• No duplicated responsibility. Deduplication is handled by the PodHeitor Storage Daemon (or by the storage backend — S3 dedup, dedup appliance). Ransomware detection is covered by storage immutability (S3 Object Lock, immutable vault) or external IDS/EDR. The M365 Plugin does not try to re-implement those functions.
• GDPR audit. Every right-to-be-forgotten operation is HMAC-SHA256 signed and written to an append-only log, so removal can be proven to an auditor independently of the catalog’s later state.
• Observability. Prometheus /metrics endpoint embedded in the binary. No sidecar required.

v1.0.0 GA quality gates

• cargo fmt --check clean
• cargo clippy --all-targets -- -D warnings (pedantic + restriction) clean
• cargo test --release — 220 passed, 0 failed, 1 ignored
• Lab E2E against a real Microsoft 365 tenant via cloudflared tunnel
• Chaos suite covering torn writes, corrupt cursor, malformed JSON, recovery
• Operational RUNBOOK and GATE_REPORT shipped with the package

What is not in v1.0.0 — v1.1 roadmap

To avoid misreading the purchase decision, v1.0 GA does not include the items below. They are on the v1.1 roadmap with confirmed priority:

• Restore-to-M365 (write-back to the tenant via Graph PUT/POST) — F-7.1
• Embedded PST restore — F-8
• Cross-tenant migration (mode=migrate) — F-24
• Source GDPR purge (real DELETE on Graph) — currently only local marker
• Standalone tool mode=gdpr_audit_verify

The supported flow today to restore an item to a user’s mailbox is: extract from the PodHeitor backup to local PST/EML, import via Outlook or Microsoft tooling. Anyone who needs direct write-back today should wait for v1.1 before planning adoption.

Compatibility

The plugin ships as RPM and DEB packages for the Linux distributions listed above. It runs as a PodHeitor Backup Server component. For Bacula Community 15.0.3 environments, an adapter layer exposes the same backend via Bacula’s native plugin API — useful in gradual migrations.

Contact

Heitor Faria · podheitor.com · heitor@opentechs.lat · +1 786 726-1749 · +55 61 98268-4220 (WhatsApp)

Copyright © 2026 Heitor Faria. All rights reserved.

Disponível em: Português (Portuguese (Brazil))EnglishEspañol (Spanish)