Ask three vendors for “Commvault backup as a service” and you will get three different products. One will sell you a subscription. One will sell you software and a professional services engagement. One will quote you a monthly figure and never mention a license at all.
None of them are lying. The phrase has no settled meaning, and the gap between what it means to a vendor and what it means to a buyer is where most backup procurement goes wrong.
This article sorts out the three delivery models, what each one actually costs, and how to tell which one your organization should be buying.
Why the term is confusing in the first place
In Commvault’s own documentation, Backup as a Service is a specific thing: a base service built on the Virtual Server Agent, protecting VMware and Hyper-V workloads, documented under Commvault’s managed service provider program. It describes a technical configuration.
When a CIO types the same phrase into a search bar, they almost never mean that. They mean something closer to: I have a backup problem, I do not want to hire two more people to solve it, and I would like someone else to be responsible when a restore fails at 2am.
That is a commercial question, not a technical one. And it has three answers.
Option 1: Commvault’s own SaaS
Commvault sells its platform directly as a subscription, priced per unit of what you protect — per user for Microsoft 365, Salesforce and endpoints, per TB for databases and file data, per VM pack for virtual machines. You get a tenant, you point your workloads at it, Commvault runs the infrastructure.
This fits when:
- Your estate is mostly SaaS — Microsoft 365, Salesforce, Dynamics — and the workloads map cleanly onto what Commvault packages.
- You want procurement to be a line item, not a project.
- You have the in-house skills to configure policies, test restores and interpret alerts, and simply do not want to own the hardware.
What it does not solve: the subscription buys you infrastructure, not judgment. Nobody at Commvault will tell you that your retention policy does not match your regulator’s expectations, or notice that the same job has been silently failing on one host for five weeks. Backup software has never been the hard part. Operating it is.
Watch the arithmetic. Per-unit pricing is clean at small scale and stops being clean as you grow. Volume discounts start at thresholds, and an estate spread thinly across many workload types can miss every one of them at once. Model the bill at the size you expect to be in three years, not the size you are today.
Option 2: Self-managed Commvault
You buy the licenses, you stand up the infrastructure, your team runs it. This is still how a large share of serious Commvault estates operate, and for good reason: it is the only model that gives you complete control over where data sits, how it is tiered, and how recovery is sequenced.
This fits when:
- You have data residency or air-gap requirements that a shared service cannot meet.
- Your environment is genuinely complex — mainframe, unusual databases, deep application integration — and you need the full platform rather than a packaged subset.
- You already have Commvault expertise on staff and intend to keep it.
The cost nobody budgets for: the license is the visible number. The invisible one is two to three skilled people, their training, their on-call rotation, and the institutional risk when the one person who understands the environment resigns. Most organizations discover this eighteen months in, usually during an audit or a recovery.
Option 3: Commvault delivered by a partner
The third model is a partner running Commvault on your behalf. In practice this splits into several shapes, and the differences matter more than the labels:
| Model | Who owns the license | Who owns the infrastructure | Who operates it | Typical buyer |
|---|---|---|---|---|
| Co-managed | You | You | Your team, with partner support and optimization | Has skills, wants backup and escalation |
| Fully managed | You | You | Partner handles monitoring, troubleshooting, recovery | Owns the estate, wants the operations off its plate |
| BaaS | Partner | Partner | Partner — you send data, they handle storage, backup and recovery | Wants a monthly cost and no infrastructure |
| DRaaS | Partner | Partner | Partner, with recovery targets and failover | Needs to prove recovery, not just backup |
The useful distinction is not managed versus as-a-service. It is who owns the license and the infrastructure. That single question determines whether this sits on your balance sheet as capital or runs through opex, whether you can walk away at the end of a term, and who is accountable when a restore fails.
There is a commercial dimension too. Partners operating at scale aggregate licensing across their customer base, which can land better pricing than a single mid-sized organization negotiating alone — a point worth putting directly to any partner you shortlist.
How to choose
Four questions settle it faster than any feature matrix.
- Who gets paged when a restore fails? If you cannot name that person today, and you do not plan to hire them, you are buying a managed model whether you call it that or not.
- Is your estate packaged or peculiar? Mostly SaaS and virtual machines points to subscription or BaaS. Mainframe, regulated workloads, or deep application integration points to self-managed or co-managed.
- Can you prove recovery, or only backup? These are different claims. If your board, insurer or regulator wants evidence of tested recovery, the model needs to include testing — and most subscriptions do not.
- What happens in year three? Run the numbers at your projected size, not your current one. Per-unit subscriptions and partner contracts age very differently.
One thing every model still needs
Whichever way you consume Commvault, ransomware changes the question underneath it. Attackers go for the backup catalog first, because an organization that cannot restore has no leverage. A backup that an attacker with domain credentials can reach is not a recovery plan.
That is an architecture problem, not a delivery-model problem — and it does not go away because someone else is running the console. Isolation and immutability have to be designed in, under all three models.
Where Arrosoft fits
We sit in the third category, and we are candid that it is not always the right one. We run Commvault for organizations from thirty to thirty thousand endpoints, in co-managed, fully managed, BaaS and DRaaS shapes, with license aggregation through our Commvault partnership. Where it matters, Arrosoft AirGap integrates with Commvault to keep an isolated, immutable copy out of an attacker’s reach.
If you are still weighing the three models, a conversation is usually faster than a proposal. We will tell you when subscription or self-managed is the better answer.