Backups for a Small Team: What 3-2-1 Costs When You Actually Price It

Everyone in software can recite the 3-2-1 rule. Three copies of your data, on two different kinds of media, one of them off-site. Very few small teams have actually implemented it, and the reason is not carelessness. It is that backups are invisible work with no deadline, and that most people have never sat down and priced the thing they are avoiding.

So let us price it. And then let us talk about the copy you are almost certainly missing, which is probably not the one you think.

The rule, stated properly

The three numbers each defend against a different failure, which is the part that gets lost when the rule is repeated as a slogan.

• Three copies — the working copy plus two backups. Two, because the moment you need a backup is exactly the moment you discover the single one was corrupt.
• Two kinds of media — defending against a failure mode that takes out everything of one type. A controller fault, a filesystem bug, a synchronisation client that faithfully replicates a deletion everywhere at once.
• One off-site — defending against everything local: fire, theft, flood, and the modern version, which is an attacker with your credentials.

A synchronisation service on its own satisfies none of these properly. Cloud file sync is a convenience feature that happens to keep a copy elsewhere. It will replicate a deletion or an encrypted file to every device you own within seconds, which is the opposite of what a backup does. Version history helps, but it is bounded, and bounded history is not a restore plan.

The copy nobody has

Here is where most small teams are genuinely exposed, and it is not laptops. Laptops get replaced and people have mostly learnt to keep the important things somewhere shared. The gap is the shared thing itself: the email, the documents, the shared drives, the project tracker, the accounting system.

Providers are direct about this when you read the documentation rather than the marketing. Microsoft's shared responsibility model sets out a matrix across on-premises, infrastructure, platform and software services, and customer data sits in the customer column in every one of them. The list of things you always retain regardless of deployment type begins with data, followed by endpoints, accounts and access management. Google's terms are structured the same way.

The provider guarantees the platform will not lose your data. It does not guarantee that you will not, and every way you might lose it — a deletion, a departing employee, a compromised account, a retention rule — is on your side of the line.

Microsoft's own documentation lists insufficient backup and disaster recovery among the responsibilities organisations commonly leave unmet, noting that backups are often infrequent, untested, or stored on-site. That is a fair description of most small teams, including ones that would describe themselves as careful.

The practical exposures are mundane. Someone deletes a shared drive during a tidy-up and nobody notices for two months. An employee leaves, their account is closed on the last day, and their files go with it. A compromised mailbox has its contents deleted by whoever got in. In each case the recovery window is a bin that empties itself, and once it has emptied there is nothing to recover from.

What it costs, with the arithmetic shown

Object storage is the reason this argument has changed. Pay-as-you-go pricing at Backblaze B2 currently sits at $6.95 per terabyte per month. The sum for the off-site copy is therefore short:

Data you cannot lose	Off-site copy per month	Per year
250 GB	About $1.75	About $21
500 GB	About $3.50	About $42
1 TB	$6.95	About $83
2 TB	About $13.90	About $167

Two things make the real figure lower than this table suggests. Deduplication means a daily snapshot of a mostly unchanged filesystem adds very little, so your stored volume grows far more slowly than the number of snapshots. And the amount of genuinely irreplaceable data in a small business is almost always less than people guess — the media library is large, the accounting records and the contracts are not.

Then there is the cost that catches people out. Storage is cheap everywhere; getting your data back is not. Several object stores bill for every gigabyte downloaded, so the day you need a full restore is the day you get an unexpected invoice. B2 includes free egress up to three times your average monthly storage, with anything beyond that charged at a cent per gigabyte, and the routine API calls are free. So with 1 TB stored, a complete restore costs nothing and you could do it three times in a month before paying anything.

Set against a software budget, this is noise. If you have been through the exercise of auditing what a small team spends on software, you already know there is a forgotten subscription costing more than this every month. Backups are one of the few line items where the cheap answer and the correct answer are the same.

The tools worth learning

Two open-source tools cover nearly all of it, and both are worth the hour it takes to learn them.

restic does encrypted, deduplicated, snapshot-based backup. It writes to local disks, SFTP, S3 and anything S3-compatible, Backblaze B2, Azure Blob Storage, Google Cloud Storage, and anything else through rclone. Snapshots are content-addressed, so a daily backup of a mostly unchanged directory stores only what changed. It has a built-in integrity check, which matters more than any other feature on this list — it means you can verify the backup is intact without performing a full restore.

restic -r b2:your-bucket:/laptops backup /home/work
restic -r b2:your-bucket:/laptops forget --keep-daily 7 --keep-weekly 5 --keep-monthly 12 --prune
restic -r b2:your-bucket:/laptops check --read-data-subset 5%

Those three commands are a complete backup strategy: take a snapshot, expire old ones on a retention schedule, and verify a sample of the actual data rather than just the index. Put them on a timer and most of the problem is solved.

rclone is the other half, and it is what you want for the SaaS gap. It speaks over seventy storage services, checks MD5 and SHA1 hashes on every transfer so you know what arrived matches what left, and can mount remote storage as a disk. Point it at a scheduled export from your document suite and it will pull that export into storage you control, which is the copy nobody has.

The encryption in restic creates one new obligation worth naming: a key you must not lose. An encrypted backup with a forgotten passphrase is indistinguishable from no backup. Store it the way you store everything else that unlocks the business — in your password manager, with recovery access for at least one other person. If you have not looked at that side of things recently, the recent changes across password manager pricing are a reasonable prompt to check who can actually get in if you are unavailable.

Ransomware changed one of the numbers

The classic rule was written when the threats were fire and hardware failure, both of which are indifferent to your backups. An attacker is not. Anyone who gets credentials good enough to encrypt your files will look for the backups and delete them first, and a backup destination your production machine can write to is a backup destination your production machine can also erase.

Two answers, and you want at least one of them.

• Object lock. Most object stores can mark objects immutable for a set period. Once written, nothing deletes them until that period expires — not you, not an administrator, not someone holding your credentials. Fourteen days of immutability is enough for almost any small team, because almost every incident is discovered inside two weeks.
• Append-only credentials. Give the backup job an application key that can write and list but not delete. Pruning old snapshots then runs separately, on a schedule, using a different key that lives somewhere the production machine cannot reach.

This is the change worth making if you make only one. It converts your off-site copy from something an attacker can remove into something they cannot, and it costs nothing.

The part that actually counts

A backup you have never restored from is a hypothesis. Teams discover this at the worst possible moment, usually finding that the job had been failing silently for months, or that it was backing up the application directory but not the database, or that nobody knows the passphrase because the person who set it up has left.

The test is deliberately small so that you will actually do it. Once a quarter:

1. Pick a file nobody has touched in months — not a recent one, which may still exist in a cache somewhere.
2. Restore it to a scratch location from the off-site copy specifically, not the local one.
3. Open it and confirm it is what it should be.
4. Write down how long it took, start to finish, including finding the passphrase.

That last number is the one worth having. When something has gone badly wrong and someone asks how long until things are back, the difference between an answer and a guess is whether you have ever timed it.

What we would do at three sizes

• One person, working alone: an external drive with the operating system's own backup tool, plus restic to object storage on a daily timer. Around three dollars a month, two hours to set up once, and it covers the laptop being stolen and the laptop being encrypted.
• Two to ten people on a document suite: the above for machines, plus a scheduled export of the shared drives and mail pulled into your own storage with rclone. This is the copy that is missing almost everywhere, and it is the one that saves you from a deletion nobody notices for a month.
• Running your own infrastructure: the above, plus database dumps to the same repository with object lock and append-only credentials, plus a restore rehearsal into a scratch environment every quarter rather than every year.

None of this is difficult and none of it is expensive. It fails to get done because it defends against something that has not happened yet, and there is always a task with a deadline instead. The way we would frame it to anyone weighing it up: an afternoon and the price of a couple of coffees a month, against the category of incident that ends small businesses. Set the timer, and then go and restore one file so you know it works.