Know Your Cloud Backup Responsibilities

Creating backups is essential, and for many, cloud backups are the go-to solution for safeguarding our data. However, there’s often confusion about how these backups function and whether they adequately protect our data. As we marked World Backup Day last month, it’s timely to explore who bears responsibility for data backups in the cloud.

Safeguarding your data is paramount. Emails can vanish, project files might disappear, and critical spreadsheets could end up on someone else’s device. Many threats to data are everyday occurrences, such as device malfunctions or accidental deletions. Then, there are more sinister risks like ransomware attacks or deliberate deletion by malicious insiders.

To ensure the safety of our data, regular backups are essential. While storing backups onsite, such as on an external drive or network-attached storage (NAS), can be cumbersome or costly, many organizations turn to cloud backups. This method is highly effective and often a cornerstone of a robust backup strategy (ideally, you should have at least two copies of your most vital data).

But there is a catch: not all cloud backups mean the same thing.

Even though over half of us use cloud backups to store our data, only 12 percent use proper cloud backups. The rest of us rely on our cloud services for backups. This is a mistake, says Clyde van Wyk, Director and Co-founder at PaySpace:

“Good cloud services, such as PaySpace, make frequent data backups. But these backups are intended to maintain the overall service and ensure we don’t lose client data. They don’t necessarily facilitate easy recovery of specific files or data objects. The data isn’t retained for periods that would support a client’s compliance or risk-mitigation requirements. A lot of people overlook this. They think that, because you store data in a cloud service, that cloud service takes care of all their backup needs. This is rarely the case.”

Cloud responsibility vs Personal responsibility.

For backups, we can distinguish two types of cloud services. The first is a cloud backup service provider, whose job is to create and store backups for your data. The second is any other cloud service, which you access, and they create backups to maintain that service.

A cloud backup service will provide features such as long-term storage, multiple data snapshots, and easy backup and restore tools. The cloud backup service should complement a client’s backup policies. For example, if you need to keep data for tax records, a cloud backup provider can retain that data for a multi-year retention period. 

Other cloud services create backups based on their operational needs. For example, PaySpace uses Microsoft’s Azure infrastructure to create backups every few minutes. If anything goes wrong, the platform can quickly recover and start operating again. However, these backups are not necessarily archived or compatible with client backup strategies.

“The job of a cloud service’s backups is to guarantee uptime,” says van Wyk. “A cloud-based email service creates backups that can recover the service if something goes wrong. But if you accidentally delete an email and need to recover it a month later, they are unlikely to have the processes and data retention to help you. That’s not the purpose of their backups.”

What’s your backup responsibility?

A good cloud-native service, whether it’s PaySpace, Office 365, Slack, etc., will retain data in the short term to ensure service delivery. 

But if you delete a file on your side or ransomware locks your systems, you cannot expect the cloud service provider to restore that data. It’s not their core focus, and they are unlikely to have the processes or long-term retention policies to support such a recovery. This is the fundamental difference between a cloud service and a cloud backup service.

“Your data in a service is safe, but not stored in a way that acts as a backup system for your business. This concept is commonly called the Shared Responsibility Model. The cloud provider is responsible for uptime and will do backups according to that goal. The user is responsible for data retention and must create regular backups through a plan that fits their needs. Just because something is in the cloud doesn’t mean it counts as a backup,” says Clyde van Wyk, Director and Co-founder at PaySpace.

To ensure your data is safe, apply the following tips:

The Shared Responsibility Model that cloud providers support states that your data remains your responsibility.

Create a backup plan that specifies which data needs backing up and how frequently. 

Do not assume a cloud service creates backups you can use if it’s not their primary purpose.

Sharepoint, Google Drive, and similar file sharing/storage are not designed for proper backups.

Use a reputable and specialised cloud-native backup provider to create data copies.