You don't lose data in a catastrophe but on an ordinary day — a disk failure, a click on phishing, a deleted folder. We show a practical strategy that protects company data and can actually be tested.
Company data — accounting, contracts, the customer database, orders, project documentation — is today just as valuable as your warehouse or machinery. The difference is that you can lose it in seconds: a disk failure, an employee mistake, ransomware, or simply deleting the wrong folder. While an hour of website downtime annoys a company, data loss can sink it.
Most small and mid-sized firms keep their data protection in one of two states: either "some backups are running somewhere" and nobody knows exactly which, or they assume the hosting provider handles it for them. Both are a risk. In this article we walk through a practical strategy you can adopt even on a small budget — and, crucially, one you can test.
The proven backup standard is called 3-2-1 and is easy to remember: keep 3 copies of your data, on 2 different types of media, with 1 copy off-site. Why exactly this?
A modern addition brings one more rule — "1 copy offline or immutable" — a copy the attacker cannot delete even with full network access. Immutable backups are today the strongest defence against ransomware.
For a smaller company this need not be expensive or complicated: production data runs on the server, one automated copy is stored on a separate disk or NAS in the office, and a third encrypted copy travels every night to cloud storage at a different provider. The important thing is that the whole process runs automatically and without manual intervention — backups someone has to remember to make will sooner or later stop happening.
A backup that falls into the wrong hands is a data breach. It should therefore be encrypted at rest and in transit. In practice this means backup files are encrypted before they are sent to the cloud and transferred exclusively over TLS. The decryption key must never sit on the same server as the data — otherwise the encryption is pointless.
Equally important is encryption of production disks and databases and HTTPS on every service. This is not only about outside attackers — it also protects you when handing hardware in for service or decommissioning it. How hosting, backups, and operational reliability fit together is covered in our article Why hosting and DevOps matter.
The most common and most painful mistake: a company diligently backs up for years, then on the day of disaster discovers the backups are corrupted, incomplete, or that the system simply won't start from them. A backup only has value when you can actually restore from it.
That is why the strategy must include regular trial restores — ideally automated — where the backup is unpacked into an isolated environment and verified: the data matches and the application runs. Two clear parameters belong here:
These two numbers determine how often to back up and how much to invest in recovery speed. Without them, "we back up daily" is a feeling, not a plan.
Statistically, the most damage is not caused by a hacker but by your own employee — an accidentally deleted folder, a click on a fraudulent e-mail, a password written on a sticky note. Technology only helps in part; the rest is discipline:
Most successful attacks do not exploit a brilliant new hole but a known vulnerability that has had a patch available for months. Regular updates of the operating system, libraries, and applications are therefore the cheapest security investment there is. Ideally you have a process that deploys security patches automatically and in a tested way, not "when someone remembers".
Against ransomware — which encrypts data and demands a ransom — a combination of measures works: immutable off-site backups (the attacker cannot delete them), network segmentation, restricted rights, 2FA, and training people to recognise phishing. If you have a verified, clean backup out of the attacker's reach, ransomware turns from a catastrophe into a nuisance. With custom applications it pays to build these principles into the design from the start — which is what we focus on in custom software development.
If you process the personal data of customers or employees — and almost every company does — you have a legal duty to protect it adequately. GDPR does not require a specific technology but "appropriate technical and organisational measures": encryption, controlled access, backups, and the ability to restore data availability after an incident. A serious breach is moreover subject to a 72-hour notification duty. The good news is that the measures in this article — 3-2-1 backups, encryption, controlled rights, tested recovery — are exactly what GDPR expects of a company. Data security and regulatory compliance thus go hand in hand.
You don't have to introduce everything at once. A practical first step is an audit of the current state: what is backed up, where and how often, who has access to what, and whether you have ever actually tried a restore. From that comes a short list of priorities by risk and cost. We will set up automated encrypted backups following 3-2-1, regular restore tests, and sensible access rights — without needless bureaucracy. If you want the certainty that your company data will survive even a bad day, get in touch with us or take a look at our hosting and DevOps service.
It depends on how much data you can afford to lose (the RPO parameter). For a typical company the minimum is a daily automated backup; for rapidly changing data (e-shop, orders) even several times a day. More important than frequency is that backups are encrypted, off-site, and regularly tested.
No. A single disk is a single point of failure — hardware fails, it gets stolen, or ransomware encrypts it together with the server. Follow the 3-2-1 rule: three copies, two different media, one off-site. Ideally at least one copy immutable or offline.
The key is an immutable off-site backup the attacker cannot delete even with full network access. Add system updates, restricted access rights, two-factor authentication, and training people against phishing. With a clean, verified backup an attack turns from a catastrophe into a nuisance.
Get in touch and within a few days you'll have a proposed solution and a timeline. No commitments, no fluff.
