SaaS
Backup Guide

For business owners and IT teams
Principles for protecting and recovering your cloud application data

Start the guideView the planning checklist

1. What is SaaS backup?

SaaS (Software as a Service) means applications delivered online, such as email, shared documents, and customer management systems.

SaaS backup preserves copies of supported application data so it can be recovered after loss or unwanted change. A backup plan defines what is protected, how long copies are kept, and how recovery is carried out and checked.

2. Start with your business’s recovery needs

What must keep working?

Identify the people, information, and business activities most affected by missing or damaged data.

How much data could you lose?

Decide how much recent work could reasonably be recreated. This helps set the required backup frequency.

How quickly must work resume?

Set a recovery target for essential activities, including time to find, restore, and check the data.

3. Identify what needs protection

BUILD YOUR PROTECTION INVENTORY

  1. Applications

    List the cloud services your business relies on, including tools used outside the main productivity suite.

  2. Data and workspaces

    Identify important accounts, shared spaces, records, and attachments. Confirm backup and restore coverage for data types, permissions, relationships, and settings; application support alone does not establish the full scope.

  3. Owners and priorities

    Assign a business owner and decide what should be protected and recovered first.

4. Understand the protection already available

Protection
What it helps with
What to verify
Sync
Keeps information aligned across devices or services.
Whether unwanted changes and deletions also spread to connected copies.
Version history & deleted items
Can recover earlier versions or recently deleted information.
Supported items, recovery windows, permissions, and what happens after permanent deletion.
Retention & archive
Preserves information under defined policies or for future reference.
What is retained, how it can be retrieved, and whether it can be restored into everyday use.
Dedicated backup
Captures recovery copies of supported data under a backup policy.
Coverage, capture frequency, retention, restore options, and separation of storage and administration.

5. How SaaS backup and recovery work

BACKUP PATH

  1. Connect the application

    Authorise access to the agreed accounts and data. Check how backup administration and storage are separated from the source environment.

  2. Capture supported data

    Run backups according to the available schedule and check that they complete.

  3. Retain recovery points

    Keep recovery points under the configured retention policy. Confirm supported restore destinations and what remains accessible if the source account or service is unavailable.

Recovery path: select a recovery point → restore to a supported destination → verify the result

6. Set backup frequency and retention

ILLUSTRATIVE TIMELINE · EARLIER → NOW

  1. Earlier recovery points

    Retention sets how far back recovery points remain available. Plan for the data’s value and how long loss might go unnoticed; confirm what happens when an account, licence, or subscription ends.

  2. Latest successful backup

    The latest successful backup marks the most recent captured work. A longer retention period does not make captures more frequent.

  3. Current work

    Set capture frequency around how much recent work could be recreated. New changes build up between backups; frequent captures alone do not guarantee a long recovery history.

7. Protect access to your backups

Limit administration

Use strong sign-in protection, appropriate roles, and separate administrative access where supported. Assess how a compromise of the working environment could affect backup access.

Control changes and deletion

Review retention changes, deletion permissions, audit records, and any immutability or approval controls.

Keep recovery accessible

Document how authorised people can reach backups during an incident, including when normal accounts are unavailable.

8. Plan and test recovery

FROM RECOVERY REQUEST TO USABLE DATA

  1. Request and approve

    Identify missing data, business priority, and restore approvers. Plan tests for a single item, a shared workspace, and account deletion or compromise where supported.

  2. Select and restore

    Choose a recovery point and supported destination. Check the effect on existing data, along with restored content, access, and dependencies.

  3. Validate and record

    A completed job alone does not prove usable recovery. Ask the owner to validate the result; record time taken, gaps, and follow-up actions.

9. Evaluate a backup solution

YOUR PLANNING CHECKLIST

  1. Coverage

    Does it protect the required applications, data types, shared spaces, and newly added users? Verify scope in current documentation.

  2. Recovery

    Can you restore required items and larger datasets to the right destination within your target? Confirm this in a practical recovery test.

  3. Security and separation

    Who can access or delete copies, and how are backups separated from the source environment?

  4. Storage and retention

    Where is data stored, how long is it kept, and what happens to copies of removed accounts?

  5. Operations and support

    Are failures visible, reports useful, and recovery support available? Record evidence, an owner, limitations, and follow-up for each checklist answer.

  6. Cost and exit options

    What affects the total cost, and how can you retrieve or retain data if you change or leave the service?

10. Operate and review your backup plan

AN ONGOING RESPONSIBILITY

  1. Monitor

    Assign an owner to check job results, alerts, and whether the intended data remains in scope.

  2. Resolve

    Investigate failures, access problems, and gaps in protection.

  3. Test

    Run planned restores and compare the result with recovery targets.

  4. Review

    Agree a review schedule. Update coverage, policies, costs, and instructions as applications, users, priorities, or service capabilities change.

Repeat the cycle and track improvements through to completion

11. Explore platform guides

Microsoft 365 data recovery

Review the questions to ask about Microsoft 365 protection and your organisation’s recovery needs.

Read the Microsoft 365 explainer

Google Workspace data recovery

Explore the roles of built-in protection, retention, and backup for Google Workspace data.

Read the Google Workspace explainer

Need help applying the backup guide?

Bring your application list and recovery questions. We’ll help you assess gaps, compare suitable options, and plan a recovery test.

Request a backup assessmentExplore data protection services