Cloud is not a backup: protecting SaaS data and finding shadow IT.

Moving to the cloud does not remove the need for backup.

Availability is not recovery

Providers keep their services running. They do not promise to restore your deleted mailbox from last quarter, undo a mass deletion by a compromised account, or reverse a ransomware sync. Retention settings are limited, and the responsibility for the data stays with you.

What to back up

Email, calendars, shared drives, document libraries, chat history where needed and identity configuration. Use an independent backup service with separate credentials, retention that matches your policy, and tested restores.

Shadow IT

Staff sign up for tools on their own: file sharing, note apps, design tools, AI services. Some hold company data with no oversight.

• Discover applications through sign-in logs and expense reports.
• Offer approved alternatives that are easy to use.
• Use single sign-on so access can be removed in one place.
• Set rules on what data may go into which tool.

Governance

Keep an application register with owner, data type, contract end and who has admin rights. Review it yearly.

Costs

Unused licences add up. Review them quarterly.