Ask a small business owner whether they have backups and the answer is almost always yes. Ask what happens if a file is deleted by mistake and discovered three weeks later, or if ransomware encrypts every file on the network, and the answer gets a lot less confident.
Here is the uncomfortable truth we run into regularly: a great many businesses have file syncing and believe they have backups. They are not the same thing, and the difference only becomes obvious on the worst possible day.
Why Syncing Is Not Backing Up
Dropbox, OneDrive, Google Drive, and iCloud are sync services. Their job is to make sure every copy matches. That is genuinely useful, and it does protect you from a dead laptop. But it protects you from exactly one kind of disaster.
If a file gets deleted, sync faithfully deletes it everywhere. If a file gets corrupted, sync distributes the corruption. If ransomware encrypts your documents, sync uploads the encrypted versions and overwrites the good ones, in seconds, automatically. The thing that makes syncing convenient is precisely what makes it dangerous as a safety net.
Most sync services do keep deleted files and old versions for a limited window, often 30 days on consumer plans. That is a genuine safety feature and worth knowing how to use. But it is a short window, it usually does not cover everything, and finding out how it works during an actual emergency is not the moment you want to learn.
The 3-2-1 Rule
The standard that IT people use is easy to remember: three copies of your data, on two different types of storage, with one copy off site.
The three copies include the live one you work on every day. Two types of storage means, for example, the computer itself plus an external drive or a cloud service, so a single failure or a single piece of software cannot take out everything. One copy off site covers fire, flood, and theft, which are the scenarios people plan for least and that end businesses most reliably.
Increasingly there is a fourth idea worth adding: at least one copy that cannot be changed or deleted, even by someone with your password. Cloud backup providers call this immutable or object-lock storage. It exists specifically because modern ransomware goes looking for the backups first.
The Part Everyone Skips
A backup you have never restored from is a hypothesis, not a backup.
We say this from experience. Before any risky database work on a client site, we take a backup, and then we confirm the backup file is actually there and actually complete before touching anything. It takes two extra minutes and it has never once been wasted effort.
Twice a year, pick a real file, delete nothing, and simply practice retrieving an old version of it from your backup. You are testing three things: that the backup is running at all, that it contains what you think it contains, and that you remember how to get things out of it under pressure. Plenty of businesses discover during this exercise that their backup software stopped working months ago and nobody noticed, because backup software that has quietly failed looks exactly like backup software that has nothing to do.
What to Make Sure Is Included
Backup plans tend to cover the obvious documents and miss the things that are painful to rebuild:
- Your website. Files and database both. Many hosting plans include backups, but check how far back they go and whether you can retrieve one yourself without calling support.
- Your email. If your business runs on a hosted mailbox, understand what happens if an account is deleted or compromised. Retention policies are not backups.
- Accounting and point of sale data, especially if it lives in a desktop application on one particular computer.
- Photos, contracts, and anything scanned. The originals are often long gone.
A Reasonable Setup for a Small Business
You do not need enterprise infrastructure. For most of the businesses we work with, a solid arrangement looks like this: an automatic cloud backup service running continuously in the background, an external drive that gets an automatic local backup for fast recovery of ordinary mistakes, and a documented understanding of who to call and what to do. Total cost is usually a few dollars a month per computer, which is a rounding error against the cost of losing a year of records.
If you are not certain what is currently being backed up (and “not certain” is the honest answer for most people), that uncertainty is worth resolving before something forces the issue. Get in touch and we will help you find out.