Online backup, also called cloud backup, copies data over an internet connection to remote storage so it can be recovered after loss, damage, or unwanted changes. A useful backup system automates that process, retains recoverable versions, and gives you a clear way to restore them.
A laptop can be stolen, a drive can fail, and an important folder can be deleted by mistake. An off-site backup helps protect against events that affect the original device or an entire location. Its value depends on what was actually captured, how long it is retained, and whether you can retrieve it when needed.
Backup, cloud storage, and sync are different jobs
These features can overlap within one service, but they answer different needs. Evaluate the recovery features rather than assuming anything labeled “cloud” is a complete backup.
| Approach | Primary purpose | Recovery consideration |
|---|---|---|
| Online backup | Automatically preserve copies of selected data for recovery. | Check exclusions, retained versions, deleted-file retention, and restore options. |
| Cloud storage | Store files or objects remotely for access by people or applications. | A storage destination still needs a process for creating, retaining, and validating backups. |
| File sync | Keep files consistent across devices and shared workspaces. | Deletion or unwanted edits can propagate. Trash and version history may help, within their limits. |
| Local backup | Keep a recovery copy on a nearby drive or backup device. | Restores can be fast, but a connected copy may share exposure to malware, theft, or physical damage. |
Also check cloud-only files. A file visible in a desktop folder may be a placeholder rather than a complete local copy. Backup clients may exclude these files or entire managed sync folders. Backblaze's explanation of cloud-sync coverage illustrates why support must be verified for the specific backup client and sync service.
How online backup works
- Select the data: Install a backup client or connect a supported data source. Review included folders, external drives, file types, and exclusions.
- Create the first copy: The initial backup uploads the selected data. Large collections can take days, depending on upload speed and service behavior.
- Capture changes: Subsequent backups usually transfer new or changed data. Some systems work at file level; others send only changed blocks.
- Retain recovery points: Retention rules determine how long earlier versions and deleted files remain available.
- Restore when needed: Retrieve files or a supported system backup to the original device or a replacement, using the service's recovery tools.
Automatic backup still depends on the device being available, the client running, adequate storage, and a working connection. “Scheduled” does not mean “completed.” Look for the time of the last successful backup and investigate errors or long gaps.
File backup is not always a full system backup
File backup may recover your documents and photos without restoring the operating system, installed applications, or machine settings. Image-based or bare-metal recovery can cover more of the system, but support and hardware requirements vary. Decide whether you need your files back or an entire working machine, then verify that the product supports that outcome.
Build a plan with more than one recovery path
The 3-2-1 approach is a useful starting point: keep three copies of important data, including the working copy, on two different media types, with one copy off-site. For example, a computer, a local backup drive, and an online backup can provide complementary recovery options. CISA describes the 3-2-1 strategy in its ransomware guidance.
A permanently connected backup can still be exposed to an attack on the computer or its credentials. Keep an offline copy where practical, or use appropriately configured immutable storage that prevents changes or deletion for a specified period. Immutability depends on the service's retention settings and access controls.
For a household
Identify irreplaceable photos, personal records, and creative work. Combine automatic off-site backup with a local copy, and store account recovery information somewhere you can access if the computer is lost.
For a small business
Inventory computers, shared storage, hosted email, and business applications. Assign someone to review backup failures, document restore procedures, and ensure another authorized person can recover data if the usual administrator is unavailable.
Decide how much loss and downtime you can tolerate
Recovery point objective (RPO) is the maximum acceptable amount of data loss measured in time. If losing a day's work is unacceptable, a nightly backup may be too infrequent. Recovery time objective (RTO) is the target time to restore service. Downloading terabytes may not meet a short RTO even when the backup is intact.
These are planning targets, not guarantees made by installing backup software. The actual result depends on successful backup frequency and the entire recovery process.
What to check before choosing a service
Compare services against your actual devices and a realistic recovery scenario. Storage capacity is only one part of the decision.
Coverage and exclusions
Confirm operating-system support and treatment of external drives, network storage, large files, and cloud-sync folders. Check what happens when a drive is disconnected for an extended period. Do not assume a computer plan also protects a phone or a NAS.
Version history and retention
Find out how long overwritten and deleted files remain recoverable, whether older versions cost extra, and what happens when you stop backing up a device. A short retention window may expire before you notice a problem.
Encryption and key ownership
Check encryption during transfer and in storage. If a service offers client-side encryption with a key you control, understand where decryption occurs and how recovery works. Losing the only usable key can make the backup unreadable.
Account protection
Use a unique password and multifactor authentication. For business use, separate backup administration from everyday access and limit who can erase recovery points. Secure recovery codes and document how authorized people regain access.
Restore options
Check whether you can recover a single file, a folder tree, or a complete system. Ask about download limits, temporary space requirements, permissions, and any physical-drive delivery option. Test recovery to a replacement device.
Total cost and exit options
Account for devices, capacity, retention, retrieval or egress charges, and recovery media. Verify how to export data and how long it remains available after cancellation. Keep a working replacement backup before ending an existing service.
For business data, also review storage locations, contractual terms, access logs, and the handling of sensitive information. A provider's security features must be configured for your needs; the label “encrypted” alone does not establish who can access the data.
Plan for the time it takes to get data back
Your upload speed determines how quickly the first remote copy can be completed. Download speed affects recovery, but server limits, many small files, decryption, and disk performance can also slow it down.
Test a restore before you need one
- Choose a representative sample: Include documents, photos, a large file, and any specialized data that matters to you.
- Restore to a separate location: Avoid overwriting your working files during the test.
- Open the recovered data: Check contents, folder structure, and important metadata. For critical data, compare checksums where appropriate.
- Recover an older version: Use a disposable test file to verify both version history and deleted-file recovery.
- Record the process and duration: Confirm that credentials, recovery keys, and instructions will be available without the original computer.
Repeat tests periodically and after significant changes to devices, backup settings, or data sources. CISA's StopRansomware Guide recommends offline, encrypted backups and regular testing of their availability and integrity.
If you are recovering from malware, use a clean environment and a recovery point that predates the incident. Restoring files alone does not remove an attacker or fix the weakness that allowed access.
Common questions
Is online backup enough by itself?
It provides valuable off-site protection, but access depends on connectivity, account access, and the service. An independent local or offline copy adds another recovery option, especially for large restores.
Does online backup protect against ransomware?
It can help recover earlier data if clean versions survive. Protection is weaker when an attacker can delete backups or when encrypted files replace all retained versions. Retention, protected copies, and secured administration matter alongside the backup itself.
Are email and cloud applications automatically covered?
Not necessarily. A desktop backup may only capture downloaded files, and live databases can require application-aware backup methods for consistent recovery. Hosted email and other cloud applications may need a supported cloud-to-cloud backup or a separate export process. Verify messages, attachments, permissions, and other required records in a restore test.
Can I delete local files after backing them up?
Only if the service explicitly supports the archival use you need. Many backup products eventually remove copies of files deleted from the source. A backup is not automatically permanent storage, and moving the only copy to the cloud leaves you with just one copy.
How do I know the backup is working?
Review the last successful run, confirm that important folders appear in the recovery interface, and restore a sample. A green status indicator is useful, but a successful restore is stronger evidence that your recovery plan works.
Further reading
- CISA: StopRansomware Guide — backup protection and recovery guidance.
- CISA: How to Protect the Data Stored on Your Devices — offline copies and recovery-key considerations.
- Backblaze: Cloud Sync and Backup Coverage — a provider's explanation of placeholder files and coverage limitations.