Digitalise your business for zero euros - Chapter 9

Backups that work when they need to

In the previous chapter we set up electronic signatures. All documents signed, stored, auditable. Then comes a moment nobody wants to think about: when you need to restore data because it was deleted, the database failed, or ransomware got in without warning. That moment always arrives. This chapter is about being ready for it, and doing it without spending money you don't have.

The hard truth: what happens when you try to restore

A company email vanishes. Not an accident. The director had two accounts mixed up and deleted the "Important Contacts" folder. They have three days to recover it.

You open the Google Workspace dashboard. Search the bin. The bin is empty.

The call to your cloud provider lasts fifteen minutes. The answer: "We have backups, but you need an active recovery plan. That costs extra, and you needed to have subscribed before the incident".

You hadn't subscribed.

This happens in 60% of SMEs. The data exists, it's on the provider's servers, but you're not authorised to get it back without paying an amount you didn't expect. Or worse: you discover your ERP backup only covers documents, not the configuration database. Without that, restoration takes weeks.

Here's the approach that works: copies you control, where you need them, verified each month.

The 3-2-1 rule: simple, brutal, effective

The standard recommended by NIST SP 800-34 and every security expert is 3-2-1:

• 3 copies of your data.
• 2 different media (not everything on one drive. One in the cloud, one on physical media, one with another provider).
• 1 offsite copy (geographically separate, so if your building burns down, the backup is elsewhere).

Sounds complicated. In reality, with free tools, it's three commands.

Here it is applied to your situation:

Corporate email (Google Workspace or Microsoft 365)

Copy 1: Google Vault (native, free)

Google Workspace includes Google Vault. Go to Admin > Compliance > Vault. Create a rule: "Save all incoming emails to a backup folder, automatically, each month".

Cost: 0 €. It's included in any Workspace plan (even Business Starter).

Coverage: all emails, including those deleted 30 days ago (Google keeps them in the bin).

Restore time: 2 minutes if you need a single email. 30 minutes if you need to restore an entire account.

Copy 2: Manual export to Google Drive (free via Google Takeout)

Once a month (or every three months), download your emails via Google Takeout (takeout.google.com). Generate an MBOX file of your entire history. Save it to a Google Drive folder called "Backups".

Cost: 0 €. Takeout is an official Google tool.

Coverage: all emails, contacts, calendar, documents if you want.

Advantage: the file is yours, it's in your Drive, it doesn't depend on Vault. If Workspace disappeared (impossible, but hypothetically), you have everything in MBOX that you can import to another provider.

Copy 3: Duplicati to external drive (free, open source)

Download Duplicati (duplicati.com, free). Install it on your machine. Set up automatic backup of the MBOX file that's in Drive.

Workflow:

1. Google Takeout exports MBOX every first Friday of the month to Drive.
2. Duplicati syncs Drive with an external USB drive (encrypted with AES-256).
3. The USB drive is stored at home, in a different location from the office.

Cost: 0 € (Duplicati is free, open source).

Coverage: encrypted copy of your emails, offline, geographically separate.

Restore time: 5 minutes. Plug in the USB, copy the MBOX to your machine, import it into your email client or Workspace.

Media: Google Drive (cloud), external USB (physical), both in different locations.

Files in Drive and Dropbox: what the provider doesn't cover

Google Drive and Dropbox store your files. They also offer version recovery. But there are catches.

What Drive or Dropbox doesn't cover:

• Deleted versions: if you delete a file, you have 30 days (Drive) or 180 days (Dropbox) to recover it. After that, it's gone. Full stop.
• Encrypted changes: if malware gets in and encrypts your files (ransomware), Drive and Dropbox will sync those encrypted versions. The "backup" will be encrypted. It's useless to you.
• Two-way sync: if you set up Drive on your local machine and delete a file, Drive deletes it too (that's the point of sync, but it's a risk).

Copy 1: Automatic snapshots in Dropbox (included)

Dropbox includes Snapshots on paid plans (Dropbox Family, Professional, Business). It automatically saves versions every 30 minutes, for 6 months.

If you go for Dropbox Pro (now 11.99 €/month in Spain), you get Snapshots.

Cost: 11.99 €/month if you need them. For small businesses, it's worth it.

Coverage: all versions of all files for 6 months.

Restore time: 3 minutes. Click "Restore folder" from Dropbox web.

Copy 2: Google Drive to Duplicati (free)

Duplicati downloads all your Drive files locally, encrypts them with AES-256, and stores them in:

• An external USB drive (offsite).
• Or Duplicati Cloud Storage (Duplicati free plan: 5 GB).

Set up in 10 minutes:

1. Install Duplicati.
2. Select source: Google Drive (Duplicati connects via OAuth, no passwords in plain text).
3. Select destination: USB drive or Duplicati Storage.
4. Encryption: AES-256 (default).
5. Schedule: every Friday at 2 AM.

Cost: 0 € (Duplicati Cloud Storage free tier is 5 GB; if you need more, Duplicati costs money, but there are alternatives).

Coverage: full encrypted copy of Drive.

Restore time: 10 minutes downloading from USB or Duplicati Cloud.

Copy 3: rclone to another cloud provider (free)

rclone (rclone.org, free, open source) is the "Swiss Army knife" of cloud backup. It syncs Drive with OneDrive, Wasabi, Backblaze B2, or any other provider.

Real example:

• Your main storage: Google Drive.
• rclone copy: syncs Drive to Wasabi (cheap cloud provider, 5 €/month for 1 TB).
• Local copy: Duplicati to USB.

rclone command (Linux/Mac/Windows PowerShell):

rclone sync "Google Drive:" "Wasabi:" --log-file /var/log/rclone_sync.log

Cost: 0 € (rclone is free). Wasabi: 5 €/month (1 TB).

Media: Google Drive (primary cloud), Wasabi (secondary cloud), USB (physical).

Different locations: office (USB), Google servers (California), Wasabi servers (Virginia, USA).

ERP or CRM database: backups of critical data

Google Forms, Airtable, HubSpot... your "database" holds customer info, quotes, transactions. Exporting to Excel once a year isn't enough.

Copy 1: Scheduled export with n8n (free for 30 days, then 50 €/month if you want more)

You remember n8n from chapter 6. It's no-code automation. You can schedule automatic daily or weekly exports.

Workflow:

1. Trigger: every Sunday at 3 AM.
2. "Airtable API" node: exports all your Airtable tables.
3. "Google Sheets" node: creates a new sheet, copies the data (your weekly "snapshot").
4. "Gmail" node: sends you an email confirming the backup ran.

Cost: n8n has a limited free plan (30 executions/month). That's enough for this if it's weekly (4-5 executions). Pro plan is 50 €/month if you need more.

Coverage: full snapshot of your database each week.

Restore time: 15 minutes. Copy data from Sheets back to Airtable or import to a new sheet to compare.

Copy 2: Automatic snapshot if the provider offers it

• Airtable: doesn't offer automatic snapshots. You need third parties.
• HubSpot: Pro plan includes automatic contact backup (15 days history). Enterprise: 90 days.
• Shopify: automatic backups every week on Professional plan.

If your CRM offers it, use it. It costs less than running an export with n8n.

Copy 3: Export to CSV each month, stored in Duplicati

Manually (or automated with n8n), export your database to CSV each month. Save it to a "Backups" folder in Drive. Duplicati syncs it to your USB and Wasabi.

Cost: 0 €.

Media: Drive, USB, Wasabi (3 copies, 2 media, 1 offsite).

The monthly restore test: 20 minutes, guaranteed

This is where almost everyone fails.

You have 3 copies. Excellent. But what if none of them work when you actually need them?

Real example: company with 5 years of Excel backups. When they try to restore, they discover the old versions are in a format Excel 2007 can't read (older Excel versions). The backup exists but it's useless.

Another case: MySQL backup with mysqldump, encrypted with AES-256. When they try to restore, they can't find the decryption key anywhere. It's in an email from 2021. It happened.

Solution: monthly restore test.

Every first Monday of the month, spend 20 minutes doing this:

1. Pick a random copy (this week: the Duplicati USB. Next week: Google Drive. The week after: Wasabi).

2. Restore to a test machine or test folder, not production.

3. Verify the data is readable:

   • If it's email: open the MBOX file in Thunderbird or a simple Python script that counts the emails.
   • If it's files: open some PDFs, spreadsheets, images. Do they open?
   • If it's database: import the CSV to Google Sheets or Airtable (create a temporary table). Do the numbers match? Are the contacts complete?

4. Document the result:

   • Date of test.
   • Which copy was tested.
   • How long it took (should be under 20 minutes).
   • Did it work? Yes/No. If not, why?
   • Who did it.

5. Upload the report to Drive in a "Backups > Restore tests" folder.

Cost: 0 €. Your time.

Total duration: between 15 and 20 minutes.

Frequency: monthly. If you skip one, do two the next month.

Why does it work? Because it's not theoretical. It's a real test. You spot problems early: "Oh, the decryption key is on a sticky note, not in the password manager". Easy to fix. Otherwise you'd find out in an emergency, when everyone's panicking.

Real free tools, exact names

If you use Microsoft 365:

Common mistakes: when backup fails without you knowing

1. Backup without verifying structure

You set up Duplicati, it says "Backup complete". Perfect. Two years later, you need to restore. Start downloading... and halfway through, discover Duplicati only saved the first 50 GB of your 200 GB. The Duplicati Cloud space ran out. You never found out.

Solution: check Duplicati logs each month. Duplicati keeps logs. Find them in Settings > Logs. One minute a month.

2. Encryption password forgotten

You encrypt everything with AES-256 (good). But the password is on a sticky note on your desk. The note disappears, or you just forget it a year later.

Solution: write the password in a password manager (Bitwarden, free). Not on a sticky note.

3. Backups from a single source

You have 3 copies of Google Drive. Good. But what if Google Drive disappeared? (It won't, but hypothetically.) You have no backup of anything else.

Solution: backup multiple sources. Email, Drive, database, calendar. Each with its own 3-2-1 rule.

4. None of your backups offsite

Everything in Drive and USB in the office. Then there's a fire, flood, or theft at the office.

Solution: at least one offsite copy. Wasabi (5 €/month) is in Virginia, not your country. That's enough.

5. Not syncing before travel or business closure

You set Duplicati to run "every Friday". Friday you leave town. The backup doesn't run. When you get back, two weeks have gone by with no backup.

Solution: manually run the backup before long trips. One click in Duplicati > "Run now".

6. Switching tools without migrating

You use Duplicati for 2 years. Switch to Veeam. What happens to those 2 years of Duplicati backups? They're orphaned. Nobody checks they exist.

Solution: when you switch, do a restore test of the old backups. If they pass, disable the old tool. If not, fix it first.

When free backups aren't enough

If you're reading this, you probably have a tight budget. Free backups work for 95% of SMEs. But there are moments when paying makes sense:

Demanding RPO (Recovery Point Objective)

RPO is how much data you can afford to lose. If your business generates invoices all day and you can lose at most 1 hour of invoices, you need backup every hour. Duplicati can do this free. But if you need backup every 15 minutes, that requires more solid infrastructure.

Providers: Veeam (plans from 30 €/month), Backblaze B2 (5 €/month + $0.006 per GB restored).

Short RTO (Recovery Time Objective)

RTO is how long restoration takes. If your site must be up in under 1 hour, you can't wait to download 100 GB manually.

Specialist providers offer "instant recovery" (boot a snapshot as a virtual machine immediately). That costs: 50+ €/month.

Cheap alternative: Wasabi (5 €/month) + Duplicati (free) gives you RTO of 30 minutes in 90% of cases.

Regulatory compliance

If you handle health, financial, or child data, there are regulations (GDPR, sector rules) that require:

• Backup with daily verification.
• Independent backup witnesses (audit).
• Encryption to specific standards.

In that case, you need certified software. Example: Veeam (ISO certified, meets HIPAA, PCI-DSS). That costs.

For most: free is enough. For these: invest in the right thing.

Concrete plans by use case

Solo freelancer, no staff, < 10 clients

What you're protecting: email, maybe 5-10 documents in Drive, possibly a spreadsheet with contacts.

Plan:

1. Google Vault (native): automatic email backup.
2. Google Takeout (manual, first Friday of month): export Drive + email to MBOX.
3. Duplicati (free): save Takeout to external USB.
4. USB at home, in a different place from where you work.
5. Restore test: first Monday of month, 15 minutes.

Cost: 0 €. Your time.

Restore time: < 20 minutes.

Small business with staff and basic ERP/CRM

What you're protecting: corporate emails (5-10 users), shared Drive with documents, Airtable with clients/quotes.

Plan:

1. Google Vault (native): automatic backup of all corporate emails.
2. Duplicati on server: automatic backup of Drive to Wasabi + USB (encrypted).
3. n8n (free plan): automatic weekly export of Airtable to Google Sheets.
4. Sheets copy to Wasabi with rclone (weekly script).
5. Restore test: first Monday of month, 20 minutes.

Cost: 5 €/month (Wasabi).

Restore time: < 30 minutes.

Medium business with critical server

What you're protecting: local server with MySQL/Postgres database, locally installed ERP, corporate email, documentation.

Plan:

1. Daily database backup with mysqldump (free, local script).
2. Duplicati on server: sync backups to Wasabi + external drive + local copy.
3. Veeam Community Edition (free): snapshot of the server VM (if it's virtualised).
4. Backup to remote site: Wasabi (5 €/month) or Backblaze B2 (pay-as-you-go).
5. Restore test: 30 minutes, first Monday of month, includes database restoration to test machine.

Cost: 5-10 €/month (Wasabi or B2).

Restore time: 1-2 hours (could be less if you restore from VM snapshot).

Documentation: what to write in the README

Create a BACKUP_PLAN.md file in your Drive or repository. Include:

# Backup plan

## Version
Last updated: 2026-12-10

## 3-2-1 rule

- Email: Vault (cloud), Takeout in Drive (cloud), USB Duplicati (physical).
- Documents: native Drive, Duplicati to Wasabi, USB.
- Database: n8n export, CSV in Drive, Duplicati to Wasabi.

## Schedules

- Google Vault: continuous (automatic).
- Google Takeout: first Friday of month.
- Duplicati: every Friday 2 AM.
- n8n export: every Sunday 3 AM.
- Restore test: first Monday of month.

## Keys and access

- AES-256 passwords: in Bitwarden, under "Backup keys".
- Wasabi API: in Bitwarden, under "Cloud storage".
- Responsible contact: [your name, email].

## Incident

If you need to restore:
1. Email [contact]: "Need restore of [what] from [date]".
2. Estimated time: [20-60 min depending on case].
3. Test on test machine FIRST.
4. Then production.
5. Document what happened.

Save this to Drive. Share with your team (or whoever is responsible if it's not you).

End of series: from zero to fully digital business

In 9 chapters:

1. Domain and hosting (Ch. 1).
2. Corporate email (Ch. 1).
3. Google My Business (Ch. 1).
4. CRM: HubSpot (Ch. 2).
5. Documents and Drive (Ch. 3).
6. Automation: n8n (Ch. 6).
7. Invoicing: Verifactu (Ch. 7).
8. Electronic signature (Ch. 8, reference).
9. Backups (this one).

Your business is now digital. Data organised. Processes automated. Documents signed. And now: protected. If something breaks, you restore in under 1 hour.

The next step is scale: add users, integrate suppliers, measure ROI. But that's case-by-case consultancy.

For now: get the 3-2-1 plan running, do the monthly restore test, document everything, and sleep well.

Implementation checklist

• Enable Google Vault (if using Workspace).
• Install Duplicati on your machine.
• Set up Duplicati: Google Drive to USB + Wasabi (or Backblaze B2).
• Buy external 1 TB USB drive (if you don't have one).
• Subscribe to Wasabi (5 €/month) or open Backblaze B2 account (free, pay per use).
• Schedule Google Takeout: first Friday of month, get confirmation email.
• Set up n8n (if you have a database): automatic weekly export.
• Create BACKUP_PLAN.md and share with team.
• First Monday of month: restore test (20 minutes).
• Monthly: check Duplicati logs. All OK?

Resources and links

• NIST SP 800-34: Contingency Planning Guide (backup and disaster recovery)
• Google Vault (Workspace Admin)
• Google Takeout (export all your data)
• Duplicati (open source backup, free)
• rclone (cloud sync, free)
• n8n (automation, free plan)
• Wasabi Cloud Storage (5 €/month, 1 TB)
• Backblaze B2 (pay-as-you-go, ~0.006 €/GB download)
• Veeam Backup Community Edition (free, servers)
• Restic (very efficient incremental backup, free)

Next steps

The "Digitalise your business for zero euros" series is complete. Your business now runs digitally without depending on premium services.

What comes next is case-by-case optimisation:

• Integrate more tools (for example, Typeform for surveys).
• Scale to multiple users and permissions.
• Measure real ROI: how much has your operating cost dropped?
• Automate processes that are still manual.

For this, you need a conversation. Not an article; it's analysis of your specific business.

Need help implementing the backup plan? Book a session to review your current infrastructure, pick the exact tools for your case, and get the 3-2-1 rule running without complications.