---
title: "Backup & recovery"
description: "How we back up: 3-2-1 with at least one immutable copy, Microsoft 365 separately, RPO/RTO agreed per system, regular restore tests with a log. Veeam, Proxmox Backup Server, Microsoft 365 backup with EU location."
canonical: "https://corevatis-redesign.pages.dev/en/technology/backup/"
lang: en
schema_type: WebPage
hreflang:
  de: "https://corevatis-redesign.pages.dev/de/technik/"
  en: "https://corevatis-redesign.pages.dev/en/technology/"
---
# Backup & recovery

A backup that has never been restored is a hope. We back up 3-2-1 with an immutable copy, back up Microsoft 365 separately — and restore regularly, with a log.

## In brief

- 3-2-1: three copies, two media, one off-site
- At least one copy immutable — against ransomware and operator error
- Microsoft 365 is backed up separately; built-in retention is not a backup
- RPO and RTO agreed per client per system
- Restore tests regularly, logged with date, duration, result

## What we do

Servers — virtual and physical —, databases, file servers, Microsoft 365 (Exchange, SharePoint, OneDrive, Teams), firewall and switch configurations. Workplaces only if data lives there; our standard is that it lives centrally. For each system we define how much data loss (RPO) and downtime (RTO) is acceptable — frequency and recovery path follow from that.

## How exactly

| Parameter | Procedure |
|---|---|
| Frequency | Servers and file servers typically daily, databases more often if needed, Microsoft 365 several times a day. Exact values follow from RPO/RTO and are agreed. |
| Retention | Daily points for a period of weeks, monthly points longer; statutory retention periods are taken into account. Duration agreed per client. |
| Immutable | At least one copy with object lock or a hardened repository: cannot be deleted or encrypted within the period — not even with admin rights. |
| Location | Off-site copy in a data centre in Germany or the EU; for Microsoft 365 in the backup vendor's EU data centre. |
| Separation | Backup credentials are separate accounts with MFA, distinct from domain and tenant admins. Whoever compromises production does not get the backup. |
| Restore test | Regular spot checks (file, mailbox, single VM) and at longer intervals a full scenario (booting a system from backup). Cadence agreed per client. |
| Encryption | In transit and at rest; keys documented and stored separately — a backup whose key nobody can find is not a backup. |

## What you receive: Restore log

Every test is logged — including the ones that did not work at first. The log is the evidence cyber insurers now want to see.

- Date and time
- System and scope (file / VM / mailbox / scenario)
- Backup point used
- Time until available
- Result and deviations
- Actions, if needed

## Tools

- **Veeam** — Backup of VMware and Windows environments, hardened repository. Data location: your site + off-site copy EU. Replaceable by: any product with an immutable target and restore testing.
- **Proxmox Backup Server** — Backup of Proxmox environments, deduplication, verification. Data location: your site + off-site copy EU. Replaceable by: open source.
- **Microsoft-365-Backup (EU-Anbieter)** — Mailboxes, SharePoint, OneDrive, Teams — own retention, independent of Microsoft. Data location: vendor EU data centre. Replaceable by: any M365 backup with export.
- **RMM-Plattform** — Monitoring of backup jobs, alert on failure. Data location: EU instance. Replaceable by: —.

## What we deliberately do not do

- No backup without a restore test — a backup that has never been verified does not count as existing for us
- No backup reachable with domain admin rights
- No "Microsoft takes care of that" — retention policies are not a backup
- No copy outside the EU without your explicit decision

## Prerequisites on your side

- Inventory of systems with RPO/RTO rating (we do this in the assessment)
- Local storage target and access to the off-site target
- Decision on retention
- A window for restore tests in which a test system may run

## Questions from IT

**Why back up Microsoft 365 separately — it is already in the cloud?**
Because Microsoft guarantees availability, not recovery. Deleted or encrypted data is gone once retention expires, and a ransomware attack on accounts dutifully syncs into the cloud. A separate backup with its own retention is the only way back.

**How long does a recovery take?**
A file: minutes. A mailbox: under an hour. A complete VM: depending on size and target, typically hours. The RTO we agree is the time we trust ourselves with — and prove in the restore test.

**Where are the copies physically?**
One locally at your site (fast recovery), one off-site in a data centre in Germany or the EU (immutable), for Microsoft 365 in the backup vendor's EU data centre. Locations are in the documentation.

**Does the backup really help against ransomware?**
Only if it survives the encryption and is older than the infection. Hence: immutable copy, separate credentials, retention over weeks — and a restore test that shows the way back works before you need it.