In cloud services the provider protects the infrastructure, but recovering deleted data is mostly up to you. The shared responsibility model, how data gets lost and options for an independent backup.
If your email, calendar and office documents live in a cloud service, it is easy to assume the data is safe "because it's already in the cloud". In practice, the provider's commitment is usually about keeping the service running; bringing back a folder deleted by mistake, a departed employee's mailbox or files deleted from a compromised account remains largely your responsibility. This division of work is called the shared responsibility model.
The shared responsibility model
In cloud applications, responsibility is split between the service provider and the customer. The provider runs the data centre, servers, network and the application itself, and protects the infrastructure against events such as hardware failure or a data centre going offline. You manage user accounts, access permissions, sharing settings and decisions about the data itself.
In practice this means that the copies the provider keeps for its own infrastructure may not be designed to bring back a single file one of your users deleted. A deletion made from your account is, as far as the system is concerned, your request, and the copies in the infrastructure follow that change.
| Area | Usually whose? |
|---|---|
| Data centre, hardware and network failures | Provider |
| Running and updating the application | Provider |
| User accounts, passwords and multi-factor authentication | Customer |
| Sharing and access permissions | Customer |
| Recovering data deleted by mistake or maliciously | Largely the customer; the provider offers time-limited tools |
| Protecting a departing employee's data | Customer |
| Backup independent of the platform, and retention policy | Customer |
The details vary by service and contract. Read the sections of your service's contract and documentation that cover data loss, restoring data and closing accounts.
How does data get lost?
Accidental deletion
A user can delete a shared folder while tidying it up, or a badly set-up email rule can move messages somewhere unexpected. It can take weeks for the loss to be noticed, by which time the recycle bin's retention period may have run out.
Problems spread by sync
Apps that sync files on a computer with the cloud carry changes in both directions. When ransomware encrypts files on a computer, the encrypted versions are uploaded to the cloud as well; a folder deleted on the computer is deleted in the cloud too. Version history can help in some cases, but its duration and scope are limited. Sync is a convenience for access, not a backup.
Compromised accounts
Through a user account whose password has been stolen, files can be deleted or a mailbox emptied. If the compromised account is an administrator account, the attacker can change retention settings and delete other accounts, and gains access to the platform's own recovery tools along with it.
Departing employees
When an employee leaves, deleting their account to free up the licence is common practice. In many services, the mailbox and files of a deleted account are permanently removed after a certain period. Customer correspondence, quotes and contracts can disappear with that account.
Losing access to the service
A payment problem, a contract dispute, account suspension or a decision to change provider can cut off access to your data temporarily or permanently. Having an independent copy helps the business keep going in such situations and also makes moving to another service easier.
How much do the platform's own tools protect you?
The recycle bin, version history, retention policies (settings that prevent data from being deleted for a set period) and legal hold features are valuable; if you use them, check that they are switched on and set up correctly. But they all sit inside the same platform and under the control of the same administrator accounts. Their durations are limited, and some are designed not to put an item back where it was easily, but to prevent its deletion or make it searchable.
The recycle bin and version history are a good first line of defence, but they live in the same account and the same service. If the account is deleted or compromised, or access to the service is cut off, you may not be able to reach these copies either. An independent backup is a copy managed separately from the main platform and its administrator accounts.
Options for an independent backup
Cloud-to-cloud backup service
These services use the permission you grant to copy email, calendars, contacts and files to a different infrastructure at regular intervals. They are relatively easy to set up and need no extra hardware on your premises; the cost is usually a recurring per-user subscription.
Backup to your own storage
Some backup software downloads cloud data to a server or storage device on your premises. The copy is entirely under your control; in return, storage space, internet bandwidth and protecting that device are also your responsibility.
Manual export
Taking a full copy at intervals with the platform's export feature is better than having no copy at all. But because it is done by hand it gets forgotten, restoring from it is laborious, and it is impractical for bringing back a single email. It is best thought of as a safeguard for emergencies or a change of service.
Questions to ask when choosing a backup service
- Scope: Are only mailboxes backed up, or also calendars, contacts, shared folders, team spaces and chat channels? Are shared mailboxes included?
- Frequency and retention: How many times a day is a backup taken, and how far back can you go?
- Restore options: Can a single email or file be restored to its original location or to another user? Can a folder be rolled back to how it was on a specific date?
- Data location and encryption: In which country are backups stored, and are they encrypted in transit and at rest? Where personal data is involved, Turkey's personal data protection law (KVKK) and the related guidance should be followed, with advice from a legal counsel where needed.
- Access security: Does the backup service's management console support multi-factor authentication? Does deleting backups require extra approval or a waiting period?
- Exit: If you leave the service, in what format can you take your backups?
Keep the backup truly independent
The backup service's administrator account should not be the same as the main platform's administrator account. A backup reached with the same identity is left unprotected once that identity is compromised. Use personal accounts and multi-factor authentication in the backup service as well.
Add a step to your leaver process: before the account is deleted, confirm its backup is up to date and, if needed, hand the mailbox and files over to a manager or archive them. Check whether newly created accounts are added to the backup scope automatically; in many services this is a separate setting.
Look at backup reports for users or folders with errors. At regular intervals, restore a single email and a folder for a randomly chosen user, and note how long it takes. Trying it for the first time during a real loss is the most expensive way to test.
Checklist
- Is it known what the provider takes on regarding data loss and recovery in the service contract?
- Are the retention periods of the recycle bin and version history known?
- Are email, calendars, files and shared spaces in a backup independent of the platform?
- Are newly created accounts added to the backup scope automatically?
- Is a departing employee's data protected before their account is deleted?
- Is administrator access to the backup service separate from the main platform and protected with multi-factor authentication?
- Has restoring a single email and a folder been tested?
- Has it been assessed where backups are stored and what obligations apply to personal data?