SaaS Data Backup: Why the Vendor Is Not Your Backup

An operations manager deleted a workspace to tidy up before a board meeting. Two years of project history went with it. Support confirmed the deletion was permanent after 30 days, and the 30 days had passed six weeks earlier.

This is the gap almost every buyer misses. Your vendor keeps the service running. Your vendor does not keep your mistakes reversible. Those are different promises, and only one of them is in the contract.

This guide explains what SaaS backup covers, what providers actually protect, which tools fill the gap, and how to test a restore before you need one.

What is SaaS backup?

SaaS backup means keeping your own independent copy of data held inside subscription tools such as email, file storage, a support desk or a sales system. The copy sits outside the vendor, under your control, with its own history. Without it, your only option after a loss is asking the vendor nicely.

The word backup gets stretched in marketing. Redundancy, replication and a recycle bin are all useful. None of them is a backup, because all of them can be wiped by the same account that caused the problem.

Does the vendor not already back this up?

The vendor backs up the platform so it can recover from its own failures. That protects the service, not your records. If you delete a folder, an employee wipes a pipeline, or an attacker uses valid credentials, the vendor sees a normal instruction and carries it out.

Read your agreement and look for the word restore. Most say the provider may assist on a best efforts basis. That phrase is doing a lot of work. It means no promise, no timeline and no guarantee of completeness.

What actually causes data loss?

Four causes, and only one involves an attacker. Human deletion is by far the most common. Then bad imports and syncs that overwrite good records. Then departing staff whose accounts get closed. Then ransomware or a compromised admin account.

1. Someone deletes it. Tidying up, ending a project, or clicking the wrong row.
2. A sync overwrites it. An integration pushes stale data over current records at three in the morning.
3. An account closes. A leaver is offboarded and files owned only by that account disappear.
4. Credentials get stolen. The attacker signs in properly, so nothing looks unusual until it does.

Point three deserves attention. Offboarding is a security task and a data task at the same time, which is why it appears again in SaaS security.

Which systems need their own backup?

Start with the four that hold records you cannot rebuild. Email and calendar. File storage. Your sales system. Your finance system. Add the support desk if conversations form part of your contractual history, which they often do.

How do you back up cloud tools?

Three routes. A dedicated backup service that connects and runs on a schedule. A scheduled export you store yourself. A script using the vendor interface. The first suits most teams, the second suits small ones, and the third only pays off for unusual systems.

Tools worth a look include Keepit, Afi, Druva, Backupify and Rewind, with the last focused on commerce and project systems. Expect roughly 3 to 6 dollars per user per month as of September 2026. Confirm with the vendor, because this market repackages pricing often.

Manual exports are genuinely fine under about ten staff. Put a recurring task in the calendar, store the file somewhere the live system cannot reach, and keep twelve months of copies. Boring beats absent. The same logic behind cloud backup for small business applies here.

What makes a backup trustworthy?

Four properties. It lives outside the system it protects. It cannot be altered for a fixed period. It keeps enough history to cover slow discovery. It restores in a usable form rather than a heap of unlabelled files.

That third property gets underestimated. Corruption often surfaces months later, so 30 days of history is not enough. National guidance agrees, and the NCSC small business guidance on backing up data is a short, sensible read for non technical owners.

What does ransomware change?

It makes deletion the attacker’s first goal. Modern operators look for backup consoles before encrypting anything, because a company with clean backups does not pay. Immutable copies, meaning storage that cannot be changed for a set period, are the direct answer.

Keep backup credentials separate from your main identity system. If one stolen admin login reaches both your live data and your backups, you do not have backups. The CISA StopRansomware material covers this pattern in plain language.

How do you test a restore?

Pick a real item, restore it somewhere safe, and time the whole thing. Do it once a quarter and write the number down. A backup nobody has restored is a belief, and beliefs perform poorly during incidents.

1. Restore one deleted email from three months ago.
2. Restore a full shared folder to a new location and open several files.
3. Restore twenty records into your sales system and check the linked notes came too.
4. Record the time each step took, including any wait for support.

Compare that recorded time against how long your business can operate without the data. If the gap is uncomfortable, change the plan rather than the expectation. Our website maintenance work runs the same drill for site data.

How long should you keep copies?

A workable default is 30 days of daily copies, 12 monthly copies, and one yearly copy for anything with a legal retention period. Check your sector rules first, since finance and health records often carry longer statutory requirements.

Do not keep everything forever. Storage is cheap but not free, and old personal data becomes a liability under privacy law rather than an asset. Where that data physically sits also matters, which is covered in how SaaS stores user data.

What should you read next?

• How SaaS handles system downtime
• What is SaaS uptime
• What is cloud software
• Case study: Lattice website security and uptime

N

Written by

Nick James

DevInfuse