Cloud and on-premises backup for companies

A backup is a copy of your data kept separately from the original, so the information can be recovered if the primary data is lost, corrupted or encrypted by an attack. The copy has to sit somewhere else and must not depend on the system it protects: if the server goes down and takes the only copy with it, it was never a backup.

Backing up means running that copy on a schedule and verifying it, not doing it by hand when somebody remembers. It comes down to three decisions: what to copy, how often, and how long to keep it. Without all three settled, you have copies, but you do not have a backup policy.

They are four different things and they get confused constantly. A backup is the copy kept for recovery, with version history. A replica is a synchronized copy ready to take over the operation, and it reproduces the error along with everything else: if the data is encrypted by ransomware, the replica encrypts too. A snapshot is a restore point held by the system itself, fast but dependent on it. Archiving moves data that is no longer in use to cheaper storage, usually for legal retention. Replication and snapshots do not replace a backup, and that is where most policies fail.

A Full copies all the data on every run: simple to restore, but it takes more space and more time. An incremental copies only what changed since the last copy of any kind: fastest to write and slowest to restore, because it needs the whole chain. A differential copies what changed since the last Full, sitting between the two on both counts. The choice depends on the backup window available and the restore time you can accept.

RPO is how much data the business accepts losing, measured in time: an RPO of 4 hours means that, in the worst case, the last 4 hours of work are gone. RTO is how long the operation can stay down before it is back. Both are set by the business, not by IT, and together they determine how often copies run and what the solution costs.

It is the most quoted practice in the field: keep three copies of the data, in two different repositories, with one of them off site. The point is that no single event, whether fire, theft or ransomware, can reach every copy at once. The original wording said two different media types, which made sense when the choice was tape or disk; today what matters is that the repositories are independent of each other. More recent versions add that one copy should be immutable or offline, precisely because of ransomware.

It depends on the RPO the business has set and on the compliance requirements of the sector. A system that changes all day needs hourly copies; one that changes once a week does not. Retention follows the same logic: you keep data for as long as you might need to recover it, and no longer, because data kept without a purpose is an LGPD risk, not security.

Very little. A backup that has never been restored is an assumption, not a guarantee. The restore test is what turns the copy into certainty, and it measures two things: whether the data comes back intact and how long it takes to come back. The second one tends to surprise people.

A backup is the copy of the data. A disaster recovery plan defines how the whole operation comes back: in what order, in how long, with which owners and in which environment. The backup feeds the plan; it is not the plan.

The LGPD treats availability as part of data security, so having a backup is part of compliance. But the policy also has to define retention, encryption, access control and where the data is stored. A backup with no disposal deadline creates the opposite problem: personal data kept beyond its purpose.

Yes. Integrity-UX is a Veeam partner, one of the world leaders in backup and data replication.

Both, depending on what is needed. Integrity-UX can design and implement the policy and also take on continuous monitoring, following runs, failures and restore tests.