Key points at a glance
- The Federal Office for Cybersecurity NCSC (BACS) recommends the 3-2-1 rule: three copies of your data, on two different storage media, with one of them kept in a different location.
- At least one backup copy should be disconnected from the computer once the backup is done. Otherwise, ransomware will encrypt it along with everything else.
- A sync service such as OneDrive or Dropbox is not a proper backup: deleted and encrypted files are synced as well.
- A backup is only as good as your ability to restore it - test this regularly.
Why backups are both a legal duty and self-protection
You must keep your business records, accounting vouchers and annual reports for 10 years (Art. 958f of the Swiss Code of Obligations, CO). Records stored electronically must remain complete, unaltered and readable at all times during this period (Accounting Records Ordinance, GeBüV, in German). A single laptop without a backup doesn't meet this requirement - one hard drive failure, and years of receipts are gone.
Then there's the risk of ransomware: malware encrypts all the files it can reach and demands a ransom. The NCSC has been warning for years that SMEs are regularly hit too. If you have a clean, separate backup, you can rebuild your systems instead of paying.
The 3-2-1 rule
| Number | Meaning | Small business example |
|---|---|---|
| 3 | Three copies: the original and two backups | Data on the laptop, one backup on an external hard drive, one with a backup service |
| 2 | Two different storage media | External hard drive and cloud storage |
| 1 | One copy in a different location | A backup service in Switzerland, or a second hard drive kept at home rather than at the office |
The NCSC also recommends disconnecting the external hard drive from the computer after each backup and not storing it right next to the computer - because of the risk of fire, water damage and theft.
Syncing is not a backup
OneDrive, Dropbox, iCloud and Google Drive keep your files up to date on all your devices. In an emergency, that's exactly the problem: if you accidentally delete a folder or ransomware encrypts your files, that gets synced too. Many services do offer a recycle bin and previous file versions - but only for a limited time and not for everything.
So the cloud is a good place to store files, but it doesn't replace a separate backup. Check with your provider how long deleted files and previous versions can be restored, and protect your account with a second factor.
Who backs up what? Cloud services at a glance
Many businesses now use several online services. It's important to know what each provider backs up - and what it doesn't:
- Business applications such as accounting or business management software: ask how often backups are made, how long they are kept and whether you can create your own export.
- Email such as Microsoft 365 or Gmail: the provider keeps the service running, but deleted emails can only be restored for a limited time. For longer retention, you need your own solution.
- Your devices: if something is only on your laptop, nobody but you is backing it up.
Example: ransomware in an email attachment
Marco runs a carpentry shop with four employees. An employee opens a fake invoice attached to an email, and the next morning all the files on the office PC and the connected network drive are encrypted. Because Marco plugs in a second hard drive every Friday, runs a backup and then unplugs it again, he has a clean backup from the previous Friday. His quotes, invoices and receipts are in his cloud-based business software anyway - nothing is lost there.
Test your restores
Many people only discover in an emergency that their backup is incomplete or unreadable. The NCSC recommends regularly checking backups for completeness and readability and practicing restoring individual files from time to time. A practical schedule:
- Once a quarter, restore a random file from the backup and open it.
- Once a year, check whether the backup contains everything you need - including new folders and programs.
- Write down how to restore your data, so someone else can do it in an emergency too.
How it works in Easly
We back up everything you enter in Easly - and you can keep your own copy at any time:
- Backed up every night: Each instance is backed up individually - the database and all files such as receipts, PDFs and personnel documents - encrypted and kept separate from all other instances.
- Tiered retention: backups from the last 14 days, plus one per week for 8 weeks and one per month for 12 months.
- Restore on request: Under "Settings → Data & recovery", you choose a backup and request a restore. We review the request and back up the current state of your instance before we roll it back.
- Your own export at any time: With one click, you create a complete export - all data as Excel and CSV, all documents in their original format - as a ZIP file to download. Ideal as a third copy on your own hard drive.
- Even after you cancel: You can still download the export for 30 days after your subscription ends.
What Easly doesn't do for you
Easly only backs up what's in Easly. Files on your devices, your mailbox and other programs still need your own backup.
Frequently asked questions
Is it enough to keep my data in OneDrive or Dropbox?
No. Syncing also carries over accidental deletions and encrypted files. Previous versions and the recycle bin only help for a limited time. Add a separate backup to the cloud, for example an external hard drive that you unplug after each backup.
How often should I back up?
As often as needed to limit data loss to what you can live with. For most small businesses, a daily automatic backup plus a weekly copy stored separately is a good standard.
How long do I have to keep backups?
There's no fixed period for the backup itself. But you must keep the business records it contains for 10 years (Art. 958f CO) - complete, unaltered and readable. So make sure old records are still stored safely somewhere, even after you replace a device.
Does Easly also back up my emails and the files on my laptop?
No. Easly backs up everything in your Easly instance - data, receipts, documents and personnel files. You back up your mailbox and the files on your devices yourself.
Information as of: see above. Sources: Swiss Code of Obligations (Art. 958f CO), Accounting Records Ordinance (GeBüV) (in German) and the data backup recommendations of the Federal Office for Cybersecurity NCSC (BACS). This article is not a substitute for individual IT advice.