Most business owners I talk to believe the same thing about their email and files. It lives in the cloud, so it is safe. Microsoft runs it, or Google runs it, and those are two of the largest technology companies on the planet. If something goes wrong, surely they can get the data back.
It is a reasonable assumption. It is also wrong in the ways that matter most, and the gap between what people assume and what is actually true is where I have watched solid companies lose years of records in a single afternoon.
This is not a scare piece. Your data is not in constant danger, and I am not going to throw made-up statistics at you. But the specific situations where cloud data disappears for good are more ordinary than most people expect. Once you have seen a few of them play out, the case for a real backup stops being a technical argument and turns into plain common sense. Let me walk you through the ones we see most often.
Why this matters more than it used to
A decade ago, your business data mostly lived on a server you owned. If you were doing things right, that server got backed up to tape or to an image, and you could restore it. Then everything moved. Your email, your documents, your shared drives, your team chat, your calendars, the working memory of the entire company now lives inside Microsoft 365 or Google Workspace.
That move was the right call for almost everyone. But plenty of businesses never updated their thinking about backup to match. The old backup you may still be paying for probably does not touch a single thing in your cloud. The most important data you own has quietly become the least protected, and most owners have no idea until the day they go looking for something that is not there.
Scenario 1: The employee who left three weeks ago
Someone gives notice, works out their time, and moves on. A month later you need a contract, an invoice, or an email thread that only ever lived in that person’s mailbox. No problem, you figure. We will just pull it back up.
Here is where it falls apart. In Google Workspace, once you delete a user account you have twenty days to restore that account and everything attached to it. After twenty days it is gone. Not archived, not recoverable through a support ticket, gone. Microsoft 365 gives you a similarly limited window on a deleted mailbox, after which the data is unrecoverable.
The catch is that offboarding almost never runs on a tidy schedule. Someone deletes the departed employee’s account to free up a paid license and trim the bill. The request for that old file lands six weeks later. By then the clock has run out, and nobody can do anything about it. The person who deleted the account did the responsible-looking thing. The data is still gone.
Scenario 2: The cleanup that went too far
This one is almost always an honest mistake. A staff member is reorganizing a shared drive or a SharePoint site, decides a folder is old clutter, and deletes it. Except that folder held the only copy of something that mattered, and half the team was linking to files inside it.
The cloud does give you a cushion here. Deleted files in SharePoint and OneDrive sit in a recycle bin for up to ninety-three days, and Google keeps deleted items in the trash for about thirty. That sounds generous until two things happen. First, the recycle bin can be emptied, by the same person who deleted the files or by an automated cleanup policy, which zeroes out your cushion instantly. Second, nobody notices the folder is missing until a quarter later, long after the window has quietly closed.
I have taken more than one call that starts with “it was in the recycle bin, I checked last month” and ends with a conversation nobody enjoys having.
Scenario 3: Ransomware or a hijacked account
Everyone pictures ransomware as an attack on a server sitting in a closet. More and more, it starts with a single stolen password and walks straight into your cloud.
An attacker who gets into one Microsoft 365 or Google Workspace account can delete mail, encrypt files that then sync to the cloud in their scrambled state, and empty the recycle bins on the way out to make recovery harder. This is the part that surprises people. The cloud faithfully replicates whatever happens to your data across its own data centers, which is fantastic for uptime and useless for recovery.
| Replication is not backup. If a file is deleted or encrypted, that is the version the cloud copies across its data centers. Replication keeps the service online. It does not bring your data back. |
A backup that lives outside the account, one the attacker cannot reach or empty, is often the only clean copy left standing after an incident like this.
Scenario 4: The insider, careless or otherwise
Most data loss is not dramatic. It is a well-meaning person clicking the wrong button. But sometimes it is not well-meaning at all. An employee sees the writing on the wall before a termination and decides to take a scorched-earth approach to their mailbox and files on the way out.
Either way, the native tools are working against you here. They are designed to give a user a short grace period to undo their own mistakes, not to protect the business from someone who is deleting on purpose, or from a deletion six months ago that you only discover you need today.
A quick word on compliance
If you are in healthcare, law, finance, or any field with records-retention rules, the stakes climb. Regulators do not accept “our email provider keeps deleted items for thirty days” as a records-retention policy. When an auditor, a lawsuit, or a patient request asks for records from two years ago, you need to actually have them. Native cloud retention was never built for that, and leaning on it is a compliance gap waiting to be found.
“But isn’t my data already backed up?”
This is the crux of it, and the honest answer is no, not in the way you mean.
Both Microsoft and Google operate on what the industry calls a shared responsibility model. In plain terms, they are responsible for keeping the service running: the infrastructure, the uptime, the physical security of the data centers. You are responsible for your actual data. That split is written into their own documentation. Microsoft’s guidance states plainly that across every type of cloud deployment, you own your data and you are responsible for protecting it.
The features people mistake for backup, the recycle bins, the trash folders, the version history, are real and useful, but they were built for quick self-service recovery, not for genuine backup and restore. They are time-limited, they often require someone to act manually, they cover a narrow slice of your data, and as we have seen, a bad actor or an ordinary cleanup can wipe them out.
To be fair, those tools earn their keep. If someone overwrites a document at ten in the morning and needs the earlier version by lunch, version history is exactly the right tool, and it is free. The mistake is treating a same-day undo button as your whole safety net. It is the difference between a spare tire and an insurance policy. You want both, and they are not interchangeable.
Here is the tell that settles the argument. In 2024, Microsoft launched its own separate, paid backup product for Microsoft 365. If the platform already backed up your data, there would be nothing to sell you. The existence of that product is Microsoft quietly confirming what those of us on this side of the industry have been saying for years. The cloud is not your backup.
What a real backup actually looks like
Once you accept that the responsibility is yours, the fix is refreshingly boring, which is exactly what you want from a backup. Here is what we set up for our clients, and what you should expect from any solution worth paying for.
It runs on its own, several times a day. You should not have to remember anything. Backups happen automatically, multiple times daily, capturing changes as they occur rather than once overnight if you are lucky.
It covers everything, not just email. That means Exchange or Gmail mailboxes, OneDrive and Google Drive files, SharePoint sites, Teams, and the calendars and contacts that quietly run your operation. If it lives in your cloud, it belongs in the backup.
It stores your data somewhere else, and locks it down. The whole point is a copy that sits outside your Microsoft 365 or Google Workspace tenant, in secure storage that ransomware in your environment cannot reach, alter, or delete.
It keeps history for as long as you need. Instead of a thirty-day or ninety-three-day cliff, retention runs for years, which is what compliance and real-world “we need that file from 2023” requests actually demand.
It restores fast, and precisely. When you need something back, you can search for a single email, one file, or a whole mailbox and restore it to a specific point in time, without dragging back a pile of other data you did not ask for. You can even restore a departed employee’s data long after their account is gone.
It gets tested, not just trusted. A backup you have never restored from is a hope, not a plan. Part of managing this properly is periodically confirming that a restore actually works, so the copy is genuinely there on the day everything else has gone sideways.
And when we manage it for you, the day-to-day disappears. We handle the setup, watch that backups are actually completing, and step in when you need something recovered. You get the copy of your data you assumed you already had.
The bottom line
None of the scenarios above are exotic. They are Tuesday. An account gets deleted a beat too early, a folder gets cleaned up a little too thoroughly, a password ends up in the wrong hands, an employee leaves on bad terms. The cloud will keep your email flowing through all of it, which is exactly what it promises to do. What it does not promise, and does not do, is hand you back the specific thing you lost after the short recovery window has closed.
A proper backup turns those afternoons from a crisis into a ten-minute task. That is the entire value. It is quiet, it is unglamorous, and the one time you need it, it is the best money you spend all year.
Not sure where you stand?
If you are not certain whether your Microsoft 365 or Google Workspace data is actually backed up, and not just replicated, it is worth a straight answer. We are happy to take a look and tell you honestly where you stand, with no pressure either way. Give us a call at (407) 720-6540 and we will walk through it with you.