A public cloud is owned by a first entity and a cloud vault target is owned by a second entity, different from the first entity. A data moving micro-service is deployed to the public cloud and another data moving micro-service is deployed to the cloud vault target. A request is issued to the public cloud for a snapshot of data to vault to the cloud vault target. The snapshot is accessed to write the data to a cloud volume in the public cloud. The data moving micro-service at the public cloud and the other data moving micro-service at the cloud vault target coordinate to read the data in the cloud volume, and deduplicate and replicate the data in the cloud volume from the public cloud to the cloud vault target.