Having your files in the cloud does not mean they are backed up. Synchronisation is a faithful mirror: it reflects the correct and the mistaken alike. A deleted file is deleted on the other side too; an encrypted file is encrypted there as well.
Short answer: what is the difference between cloud storage and backup?
Cloud storage synchronises the current version of files across devices; backup preserves past versions in a separate copy and makes them restorable. One question reveals the difference: if a file was changed by mistake three days ago, can you return to its earlier state? Synchronisation usually answers that only for a limited window; backup is built for it. The two are not alternatives but separate layers solving different problems.
Synchronisation versus backup
| Criterion | Cloud storage (sync) | Backup |
|---|---|---|
| Purpose | Access and sharing | Recovery |
| What it holds | The current version of a file | Past versions of a file |
| Deletion behaviour | Deleted everywhere | Retained in the backup |
| Version history | Usually a limited window | Long-term, per policy |
| Scope | Selected folders | System, database and configuration included |
| Restore | Per file | Whole system to a point in time |
The most critical row is scope. Cloud storage carries your files; but a website needs more than files to stand up. Without the database, server configuration, mail accounts and certificates, the files in your hands do not become a working system.
Does ransomware reach the cloud too?
Yes — and that is the most dangerous aspect of relying on sync. When files on a computer are encrypted, the sync client reads it as a change and uploads the encrypted version. Within minutes your cloud copy is unusable as well.
In that scenario only a copy the attacker cannot reach saves you. That requires three properties:
- Separation: The backup must not be reachable from the source system. A permanently attached disk or a continuously synced folder shares whatever happens to the source.
- Version history: Not just the latest state but previous days as well. Days can pass before an attack is noticed.
- Immutability: A backup that cannot be deleted or overwritten for a defined period removes the possibility of the attacker reaching it.
We examined how this threat operates and how it gets in in our ransomware article.
The right arrangement: three layers
- Working layer — cloud storage. The files the team accesses, shares and edits daily. The purpose is access, which is not the same as protection.
- Recovery layer — regular backup. An automated, scheduled and versioned copy of server, database and files. This layer must operate independently of the source system.
- Disaster layer — a copy in a separate location. A long-retention copy kept at a different physical or logistical location. It exists for a wide-scale problem on the provider side.
This arrangement rests on understanding the distinction between backup and disaster recovery, which we covered in a separate article.
Checklist
- Find out your cloud storage's version history window. How many days back can you go?
- Write down the backup's scope: files, database, e-mail, configuration — which are included?
- Check whether the backup is reachable from the source system.
- Run a restore test and record how long it takes. An untested backup is an assumption.
- Verify how long deleted files are retained.
- Monitor backup notifications. A backup failing silently is more dangerous than none at all.
- Decide who holds restore authority and add it to your access inventory.
- Align retention periods with your legal obligations.
Netişlem expert view: "we have backups" means three different things
When we hear that sentence we ask three questions: what does it cover, how far back does it go, and when was it last restored? Fewer businesses than expected answer all three clearly. The usual picture is: files are synced, the database is out of scope, and a restore has never been attempted.
Our second observation is that the confidence cloud storage creates exceeds the protection it provides. Because files are accessible, the system feels safe. But accessibility and recoverability are different things; version history and separation are what divide them.
Third, the most common cause of data loss is not attack but human error. A folder deleted by mistake, a file overwritten, a bulk operation run incorrectly. In all of those, version history is what saves you. The case for backup is not only malice — it is an ordinary Tuesday.
Frequently asked questions
My cloud storage keeps version history — isn't that enough?
It helps with short-term file mistakes, but the window is usually limited and the scope covers only synced folders. Database, server configuration and mailbox contents stay outside. Restoring a whole site requires those too.
My hosting provider takes backups — do I need my own?
Provider backups mostly address infrastructure failures and retention may be limited. A copy under your own control, in a separate location, is your only guarantee against a wide-scale provider-side problem. Have scope and retention stated in your contract.
How often should I back up?
As often as the amount of data you can afford to lose. A site taking a few orders a day and one processing hundreds of transactions an hour do not have the same need. Asking "how many hours of data can I lose" produces the right frequency by itself.
How do I run a restore test?
By restoring to a separate test environment without touching production. Measure two things: how long it takes, and whether the recovered data is complete. Repeat at least twice a year.
Should I encrypt backups?
Yes, particularly if they contain personal data. Encryption matters both for legal obligations and against the possibility of a backup reaching the wrong hands. Ensure the key is stored separately from the backup itself.
Conclusion
Cloud storage solves access; backup solves recovery. Assuming they do the same job leaves a gap that stays invisible until data is lost. The right question is not "are my files in the cloud" but "can I return to 11am yesterday".
If you would like us to assess your current backup arrangement, get in touch. You can review our cloud storage and corporate backup solutions.