There’s an assumption I hear from business owners all the time: “Our stuff is in the cloud, so it’s backed up.”
Unfortunately, those are two very different things.
Microsoft 365 and Google Workspace do an excellent job of keeping your email, documents, calendars, and other business data available. They operate massive, redundant systems designed to keep their services running even when hardware fails or something goes wrong behind the scenes.
But keeping Microsoft 365 or Google Workspace running is not the same thing as keeping an independent backup of your business data. That distinction usually doesn’t seem very important until something disappears.
We Learned This One the Hard Way
Several years ago, we had a client with an employee who decided to leave the company. Before leaving, they deleted their email and files, then went into the cloud-based recycle bin and emptied that too. This wasn’t somebody accidentally dragging the wrong folder into the trash. It was deliberate.
By the time anyone realized what had happened, the employee was gone, along with a significant amount of company data. Fortunately, the client had an independent backup, so what could have been a disaster became a recovery job instead.
That experience reinforced something we already knew. If your only copy of your cloud data is the copy sitting in the cloud service itself, you don’t really have a backup.
Cloud Storage and Cloud Backup Aren’t the Same Thing
Part of the confusion comes from the fact that Microsoft 365 and Google Workspace have features that feel a lot like backup. There are recycle bins, deleted-item recovery options, version histories, and various retention capabilities. Those are all useful, and there are plenty of situations where they can save the day.
The problem is that they are still part of the same environment where your production data lives. Their availability also depends on what happened, how the system is configured, and how much time has passed before someone realizes something is missing.
A true backup gives you another copy of that data, with its own retention and recovery capabilities.
Think about an important document in a filing cabinet. If you make a photocopy and put it in another drawer of the same filing cabinet, you technically have two copies. But if somebody walks off with the filing cabinet, you have zero copies.
Cloud backup is about having another filing cabinet.
Sometimes It’s Just a Mistake
Not every data-loss story involves a disgruntled employee or a hacker in a dark room wearing a hoodie. Most businesses employ humans, and humans occasionally delete things they shouldn’t.
Someone cleans up an old folder without realizing another employee still needs it. Someone deletes an email they thought was unimportant. A shared folder gets reorganized and something important disappears in the process. Usually somebody notices fairly quickly, but sometimes they don’t.
That last part matters. Finding out that a file was deleted yesterday is very different from discovering that a folder disappeared six months ago. Recovery features that might have helped immediately may no longer be useful by the time someone notices.
So the important question isn’t just, “Can we recover a deleted file?” It’s, “How far back can we recover it?”
Sometimes It Isn’t a Mistake
Then there are situations like the client I mentioned earlier.
Businesses have to give employees access to company information so they can do their jobs. Depending on their role, that can mean access to thousands of emails, customer records, shared folders, documents, spreadsheets, and years of institutional knowledge.
Most departing employees aren’t going to intentionally destroy company data. But “most” isn’t much comfort when you’re dealing with the one who does.
There are also less malicious versions of the same problem. Someone leaving the company may delete files because they mistakenly believe those files belong to them. An employee account might be compromised and used by someone else. Someone with legitimate access can simply make a very large mistake.
Good account management, permissions, security monitoring, and offboarding procedures can reduce those risks. Independent backup gives you another option when those controls aren’t enough.
And, Of Course, There’s Ransomware
You can’t talk about protecting business data without talking about ransomware.
Cloud services aren’t magically immune from cyberattacks. If an attacker gains access to an employee account, they may be able to do many of the same things the employee can do, including changing, deleting, or moving information. Files synchronized between a computer and cloud storage can create additional problems when compromised or encrypted data gets synchronized.
That’s why good cybersecurity uses layers. Multifactor authentication, endpoint protection, email security, properly configured permissions, monitoring, and employee training all reduce the chances of an attack succeeding.
But no security system is perfect.
Backup is what you have when prevention doesn’t work.
Don’t Forget About Email
When I talk to businesses about backup, files are usually the first thing they think about. They picture Word documents, Excel spreadsheets, PDFs, accounting exports, customer folders, and everything stored in OneDrive, SharePoint, or Google Drive.
Email often gets overlooked, which is strange when you consider how much business happens there.
Think about what’s sitting in the average employee’s mailbox. There are customer conversations, approvals, attachments, project histories, financial discussions, vendor information, contracts, scheduling details, and countless decisions that nobody ever documented anywhere else.
For many small businesses, email has quietly become an unofficial filing system.
That’s why protecting Microsoft 365 or Google Workspace shouldn’t mean protecting only the files. Email is business data too, and losing years of it can be every bit as disruptive as losing a shared drive.
Doesn’t Microsoft or Google Back This Stuff Up?
This is usually where someone asks the obvious question: “But Microsoft and Google back everything up, right?”
The better way to look at it is that Microsoft and Google are responsible for operating their platforms. You’re responsible for your business’s data.
If a server in one of Microsoft’s data centers dies, you don’t expect half your mailbox to disappear. Google doesn’t expect you to understand which physical piece of hardware contains a particular Google Drive file. They build resilient infrastructure so those kinds of failures aren’t your problem.
That’s different from your employee deleting three years of email.
Your problem isn’t keeping Microsoft 365 running. Your problem is being able to say, “We need this employee’s missing emails back,” or “We need the version of this folder from before somebody changed it,” or even, “Something happened Tuesday afternoon. Can you put our data back the way it was Monday?”
That’s backup and recovery.
The Important Part Isn’t Actually the Backup
There’s another mistake businesses make when thinking about backup: focusing entirely on whether a backup exists.
Having a backup isn’t the goal. Being able to recover from something is the goal.
If something happens tomorrow morning, how quickly can you get the business functioning again? Can you restore a deleted email? Can you retrieve an older version of a document? Can you recover an entire employee’s mailbox and files? How far back can you go? And does anyone actually know how to perform the recovery?
Those are business continuity questions, not just IT questions.
A backup that can’t be restored when you need it is just a collection of files taking up storage space.
Three Questions Worth Asking Your IT Provider
You don’t need to become a cloud-backup expert. That’s what you have an IT provider for.
But there are three questions every business owner should be able to get straightforward answers to:
Is our Microsoft 365 or Google Workspace data independently backed up?
How far back can we recover deleted or changed email and files?
If we needed something restored tomorrow, what would that process look like?
If the answer to the first question is, “Microsoft takes care of that,” “Google takes care of that,” or “There’s a recycle bin,” I’d keep asking questions.
The worst time to discover the difference between cloud storage and cloud backup is five minutes after you desperately need the backup.
The cloud is a great place for your business data. Microsoft 365 and Google Workspace have transformed the way small businesses work, and I wouldn’t want to go back to the days when everything lived on a server in the closet.
Just make sure the cloud isn’t the only place your business data exists.