Data backup services for small business
A backup is only real once somebody has restored from it.
Most small businesses have something that looks like a backup. A sync folder, a USB drive somebody takes home on Fridays, a setting in Microsoft 365 that everyone assumes is doing the job. Very few have restored from any of it.
That is the whole problem. A backup that has never been restored is an assumption, and the day you find out is the day you needed it.
What we usually find
- Platform retention mistaken for backup. Microsoft 365 and Google Workspace keep deleted items for weeks, not years. A folder deleted in April and missed until September is gone. The windows, and the gaps they leave, are in Microsoft 365 is not a backup.
- Jobs that report success and skip things. The folder somebody added last year, the shared drive nobody told the backup about, the laptop that has been off the network since March.
- Backups an attacker can reach. If the same administrator account can delete your data and your backups, one compromised password removes both. Ransomware looks for the backups first.
- Leavers taking data with them. An account deleted to save a licence takes its files with it once the grace period ends. It is the most common data loss we see, and it is entirely self-inflicted.
- No date on the last restore. Nobody can say when anything was last recovered, how long it took, or whether it worked.
What a proper backup looks like
Backup is included in every managed plan rather than sold separately. It covers:
- Microsoft 365 or Google Workspace: mail, OneDrive or Drive, SharePoint sites and shared drives
- Laptops and desktops, including the ones that are rarely in the office
- Copies held outside your main environment, behind credentials your everyday administrator accounts cannot use
- Encryption in transit and at rest, with data kept in Canada wherever the service allows
- Jobs monitored, so a backup that stops running gets noticed that week rather than that year
- Restores tested on a schedule, with the date, what was restored and how long it took written down
If you still have a server
Plenty of small offices still run a server in a cupboard: file shares, an accounting database, a line-of-business application that never moved to the cloud. It gets backed up alongside everything else, and the restore test includes bringing the application back, not just the files. We scope it in writing before you sign.
Whether that server should still exist is a separate question, and you will get a straight answer. More on the Windows Server and infrastructure page.
Four questions that tell you where you stand
- When was something last restored, and how long did it take?
- Could one compromised administrator account delete the backups?
- Is Microsoft 365 or Google Workspace data backed up outside the platform?
- What happens to a leaver's files when their account is deleted?
Why your insurer cares
Cyber insurance applications now ask whether backups are offsite, separate from your main environment, and tested. "Microsoft keeps copies" is not a yes to any of those, and an answer that turns out to be wrong can affect a claim. The questions, one at a time, are in the cyber insurance questionnaire, question by question.
What it costs
Backup is part of every managed plan, not an add-on. From $125 per user per month, $199 flat for a one-person business, month to month with no exit fee. Full detail on the pricing page.
Where we stop
We run backup and recovery for businesses under twenty-five people. Enterprise disaster recovery sites, forensic recovery after a breach, and physical recovery from a failed drive go to specialists, and we will tell you who.
Start with the insurance-readiness review
Half an hour on a screen share. We look at what is being backed up, what is not, and when anything was last restored. You keep the findings whether or not you hire anyone.
Related
Let’s make your tech boring. In the best way.
Get a free 30-minute insurance-readiness review. We’ll tell you what’s solid, what’s risky, and what we’d automate first. No pitch. No obligation.