Microsoft 365
Exchange mailboxes, SharePoint sites, OneDrive accounts and Teams content. 12-month retention as standard; longer for regulated sectors. Point-in-time restore to a day, hour or minute.
Service · Backup & DR
Business backup and disaster recovery in West Sussex
3-2-1 backups for Microsoft 365, servers and endpoints. Tested recovery — not hope — with recovery-time and recovery-point objectives written into the contract in plain English.
The rule
3 copies. 2 media. 1 off-site.
The 3-2-1 rule is the industry minimum for recoverable backup. It's survived thirty years because it works. We apply it to every client by default — Microsoft 365 data, servers and endpoints.
- 3 copies — the live data plus two backups
- 2 different media — the working copy, plus a cloud object store
- 1 off-site — an immutable copy in a UK data centre, air-gapped from your network
Immutable means the backup can't be deleted or re-written for the retention window — even with stolen admin credentials. That's the bit that saves you from ransomware.
What we back up
Everything that matters, not just the file server.
Most SMEs assume Microsoft backs up their 365 data. Microsoft protects the platform — they don't guarantee recovery of a mailbox a user deleted six months ago, or a SharePoint site a compromised admin wiped. You need a third-party backup on top.
On-prem & hybrid servers
Windows Server, Hyper-V, VMware and physical machines. Full-image and file-level restore. Optional warm standby for critical servers with a 1-hour RTO.
Endpoints
Laptop and desktop backup of user folders where the risk is stolen or lost devices. Not a replacement for OneDrive — a belt for the braces.
SaaS apps
Google Workspace, Xero, QuickBooks Online, Salesforce — backed up to the same retention and restore model where the vendor allows it.
Immutable off-site
Every backup is written to an immutable object store in a UK data centre. Ransomware that hits your live network can't reach back to delete it.
Tested recovery
Quarterly recovery tests on a sample of data. You get a written test report — not a "trust us, the backups run".
RTO & RPO
Recovery-time and recovery-point — in plain English.
Most MSPs quote RTO and RPO without explaining them. Here's the short version:
- RTO — recovery time objective. How long it takes to get you working again after an incident. "We can have your file shares readable in 4 hours."
- RPO — recovery point objective. How much data you might lose. "Backups run every hour, so the most you'd lose is 60 minutes of work."
We agree RTO and RPO per client, per system. Your email tier might be 2-hour RTO / 15-minute RPO. A rarely-touched archive server might be 24-hour RTO / daily RPO. Those targets go in the contract and we test against them.
A typical SME target set
- Microsoft 365 mail: RTO 2 hours, RPO 1 hour
- SharePoint & OneDrive: RTO 4 hours, RPO 1 hour
- Line-of-business server: RTO 4 hours, RPO 1 hour
- File server: RTO 8 hours, RPO 24 hours
- Endpoint (lost laptop): RTO 24 hours, RPO 24 hours
FAQ
Backup and DR, straight answers.
Doesn't Microsoft already back up our 365 data?
No — not in the way you think. Microsoft runs resilient infrastructure and keeps short-term recovery windows (deleted items for 30 days, mailbox retention for 14–30 days). They don't guarantee recovery of a file someone deleted last quarter, or a SharePoint site a compromised admin wiped last month. Third-party backup is the industry standard and a requirement for most cyber insurance policies.
How often are backups tested?
Automated integrity checks run on every backup. A full sample restore — we pull a random set of mailboxes, SharePoint items or server files and restore them to a sandbox — runs quarterly. You get a written report showing what we restored, how long it took, and whether we hit the RTO target. For regulated sectors we run tests monthly.
What's "immutable" backup and why does it matter?
Immutable means the backup cannot be changed or deleted for the retention window, not even by someone with admin credentials. Modern ransomware doesn't just encrypt your data — it tries to delete your backups first so you have no choice but to pay. Immutable storage breaks that playbook.
How long do you keep backups for?
12 months as standard for Microsoft 365 and servers. 7 years for clients with regulatory retention requirements (accountants, solicitors, clinics). Endpoint backup is 90 days. Retention is in the contract and matched to what your regulator, insurer or sector actually requires — we don't pay for retention you don't need.
What happens if you go bust — can we get our backups out?
Yes. Every client has an export-on-demand right in the contract. If we cease trading, there's a release clause with our backup vendor allowing you to take over the tenant directly. No hostage data, no six-figure exit fees. We'd rather you leave cleanly than worry about it.
Free backup review.
We'll scan your Microsoft 365 tenant and servers and tell you what's covered and what's exposed — free, written, yours to keep.