Backup and continuity

The demand is a price on your recovery, not on your data

Operators do not set a figure by valuing your files. They estimate what it costs you to rebuild without them, and they ask for slightly less. Everything that shortens or de-risks your recovery lowers that number, and a business with a clean, reachable, recent restore point is quoting against itself in a negotiation it does not have to enter.

This is also why finding and destroying backups is now standard practice rather than an unusually thorough intrusion. Anything reachable from a compromised administrator account should be assumed to be part of the target, including the backup server, the network share holding the images, and the cloud drive somebody was syncing to.

Outside the estate, on separate credentials, or it is not a backup

Two platforms sit behind these nine lines. Every machine line, and Microsoft 365, runs on Cove Data Protection from N-able. The three remaining cloud lines run on Dropsuite. Whichever of the two is holding it, everything on this page is sealed with AES at a 256-bit key while stored, wrapped in TLS while moving, and parked on infrastructure that forms no part of the environment being protected. Another platform, another set of credentials, another administrative boundary.

Treat that as an attack scenario rather than a datasheet entry. Whoever holds your domain administrator password can flatten anything living inside your network, retention settings and audit trail included, and the audit trail is precisely what would have shown you them doing it. What sits somewhere else is out of their reach entirely. A replica kept inside the estate buys you resilience against a failed disk. It never bought protection from a person.

Two questions decide every line you buy

How much work would you accept doing a second time. Your exposure is whatever falls between two passes. Working Files captures twice daily, putting the worst case around half a day of re-keying. Gmail captures twelve times daily, putting it under two hours. Cadence means nothing else, and it is the reason every line quotes a frequency here rather than an adjective.

How long is the business allowed to stand still. Pulling one file out of four weeks of version history is under a minute of work. Bringing back a mailbox, or a ledger out of QuickBooks, runs to minutes. A failed server rebuilt from bare metal onto fresh hardware runs to hours, and the gap between a manageable week and a ruinous one is whether you had costed those hours in advance.

Recovery testing turns an assumption into a document

Most businesses that discover their backups do not restore discover it on the worst day available. Jobs report success while quietly excluding a volume added last year. A retention change made during a storage panic removes the month you need. Nobody notices, because nobody restores anything until it is compulsory.

Fortify-CDP-Continuity carries out the restore for you, every week or every month, and hands back proof that it worked. That document is what converts your recovery time from an estimate into a measurement, and it is what a cyber insurer or a regulated client will ask to see rather than taking your word for it.

Microsoft and Google run the platform. You own the data.

That is the shared responsibility model in one line, and it is already sitting in the agreement you signed whether or not anyone reached that page. Your provider undertakes to keep the platform running. Defending what is inside it from deletion, from malice, and from a Tuesday afternoon mistake falls on your side of the boundary.

• Microsoft 365, on Cove. Mail, SharePoint, OneDrive and Teams together, holding seven years of Exchange history, a year for the rest, a pooled terabyte for every user, and no charge at all for shared mailboxes. Those shared mailboxes tend to hold the invoices and the order trail, and tend to be exactly what nobody bought a licence for.
• Google Workspace, on Dropsuite. Mail captured twelve times a day, My Drive and Shared Drive three times, contacts, calendars and tasks daily, with granular restore down to a single message.
• QuickBooks Online, on Dropsuite. Intuit makes no promise that your ledger can be recovered. This line captures it continuously, restores in a click, and prices per company file.
• Entra ID, on Dropsuite. The directory itself: users, groups, roles, applications and policy, with unlimited retention beyond Microsoft's thirty-day window, real-time change monitoring, and rollback of an unwanted change without rebuilding it by hand.