Your data always safe, even when everything else fails

Complete guide

Cloud backup for businesses: what it must cover and how to organise it

Almost every company believes it has backups. Many find out they are useless on the day they are needed: the copy was three weeks old, it sat on the same server that has just failed, or nobody had ever checked that it could be restored. This guide explains what a well-designed business backup looks like, which types of copy exist, which systems need protecting, how recovery times are set and what the GDPR requires, so that cloud backups become part of a business continuity plan rather than a box that was ticked once.

What cloud backup for businesses is and what it has to solve

A cloud backup is a replica of the company's data and systems, stored encrypted in an external data centre away from the premises and the corporate network, and generated automatically at whatever frequency has been agreed. The important part is not the word cloud but what the cloud adds compared with an external drive or a backup server in the office: the copy survives a fire, a theft, a power failure and, above all, a ransomware attack that encrypts everything connected to the network.

A business backup has to answer four questions before any technology is discussed: which data is essential to keep working, how much information can be lost at most, how long the company can be down, and who does what when an incident happens. The answers make up the business continuity plan, of which backups are the central piece. To see how that plan is built step by step, read our backup and disaster recovery guide for SMEs; our article on backup and business continuity covers the most common scenarios that put it to the test.

Types of backup and the 3-2-1 rule

Not all copies are alike, nor do they cost the same in time and storage. A full backup duplicates the whole data set every time; an incremental backup stores only what has changed since the last copy of any kind; a differential backup stores what has changed since the last full copy; a system image captures the entire server, with operating system, applications and configuration, so it can be brought up on another machine; and continuous backup replicates changes almost instantly, intended for databases and applications that cannot lose even a few minutes of work. A company normally combines several: a weekly image of the servers, daily incrementals of the data and continuous replication of the ERP database. Above whichever combination is chosen sits the 3-2-1 rule: three copies of every piece of data, on two different media, with at least one kept off-site. This table compares managed cloud backup with the local or manual copy many SMEs still rely on:

The local copy is not redundant: it is the fastest way to recover a file deleted this morning and it plays its part as one of the two media in the 3-2-1 rule. What it cannot be is the only copy. A well-designed online backup for businesses combines a nearby copy for everyday restores with an encrypted, immutable copy in the cloud for the incidents that affect the whole office.

What to protect in each sector

Every company has to protect its accounts, invoicing and email. What changes by sector is which piece of data stops the business if it disappears, and that is where the most frequent copy and the fastest recovery must be set:

• Industry: production orders, bills of materials, machine programs and the quality and batch traceability records that regulations or customers require.
• Logistics: warehouse locations, the status of every shipment, transport documentation and the integrations with customers and carriers that cannot be rebuilt by hand.
• Retail and commerce: the POS database, stock in every shop, online store orders and the receipts and invoices that invoicing rules oblige you to keep.
• Services: client files and documentation, timesheets, contracts and email, which in professional firms and consultancies is the company's real archive.
• Transport: loading orders, fleet and driver data, the legal documentation of every job and per-customer invoicing, which usually lives in several applications at once.

Which systems are included in the backup

The most common mistake is to protect the server and forget everything else. Today a company's data is spread across its own machines, cloud services, laptops and the online store, and the backup must cover all of them from a single console. These are the sources we include most often:

• Servers and virtual machines: a full system image, so the server can be started on other hardware or in the cloud if the original machine stops working.
• Microsoft 365 and Google Workspace: email, OneDrive, SharePoint, Teams and Drive. The provider guarantees the service, not the recovery of what a user deletes or an attacker encrypts; that copy is the company's responsibility.
• Databases and ERP: consistent copies of the Gestinity database or any other ERP, at the frequency dictated by how much information can be lost, with restore tests in a separate environment.
• Workstations and laptops: documents and configuration of the devices that work away from the office, backed up automatically as soon as there is a connection.
• Online store and website: files, the orders and customers database and the store configuration, so that a failed update or an attack does not mean rebuilding it.

RPO, RTO, encryption and GDPR compliance

Two indicators define what being protected actually means. The RPO (recovery point objective) is the maximum amount of work the company accepts losing: if the ERP is backed up every night, the RPO is one day; if it is replicated every fifteen minutes, it is fifteen minutes. The RTO (recovery time objective) is the longest the company can be without a system before the damage becomes serious. Each system has its own: the ERP database and the POS call for minutes or hours, while the historical archive can wait a day. Writing them down is what makes it possible to design the backup and size the service, instead of copying everything the same way and hoping it is enough.

The security of the copied data matters as much as the copy itself. Backups must travel and be stored encrypted, with keys controlled only by the company, in data centres located within the European Union, and the location, retention periods and deletion procedure must appear in the record of processing activities required by the GDPR. Then comes what separates a serious business backup from a nominal one: restore tests. A copy that has never been restored is a hypothesis. Scheduling regular restores of files, databases and complete servers, measuring how long they take and documenting the result is the only way to know that the business continuity plan will work on the day it is needed.

Signs that your company needs to review its backup

Just one of these signs is reason enough to review the strategy. With two or more, the company is trusting its continuity to luck. The starting point is an audit of what exists: what is copied, where, how often and what has been tested, and the backup policy is designed from there.

Backup for businesses across Spain

We implement and manage backup for businesses throughout Spain from our offices in Murcia and Madrid, carrying out the initial inventory and the restore tests remotely or on the client's premises. These are some of the provinces where we work most:

Why Grupo Unifema

We are a software development consultancy with more than 20 years of experience and the makers of the Gestinity ERP. We know backups from the side of someone who has to restore a management database and be invoicing again that same morning, not only from the infrastructure side. That is why we design the backup around the company's processes and systems, and integrate it with the ERP, the online store and the custom applications it already runs.

Every project starts with an inventory of critical data and a proposed RPO and RTO per system. We then configure the backup policy, run the first full copy and a test restore, and from there we monitor every execution, alert you if anything fails and repeat the recovery tests regularly, with a stable contact who knows your installation.

Request a backup audit