Your SaaS Vendor Does Not Back Up Your Data

The Decision in Front of You

Most companies moved their critical records into SaaS over the last decade: Microsoft 365 or Google Workspace for mail and documents, Salesforce or a similar platform for customers, a cloud ERP for orders and finance. The decision is whether to pay for an independent copy of that data and the discipline to restore it, or to rely on whatever the provider keeps.

The providers have answered half of that question in writing. The Microsoft Services Agreement recommends that customers regularly back up the content they store on Microsoft's services, and warns that customers may be unable to retrieve their data during an outage ¹. Microsoft's shared responsibility model assigns customer data, configuration and identities to the customer in every deployment type, SaaS included ². Salesforce's own training tells customers they are responsible for protecting the data they put into Salesforce, including against accidental or malicious user actions ³.

The stakes are the records the business runs on. A deleted sales pipeline, a corrupted price book or an encrypted document library is a revenue, legal and regulatory problem the day it happens. The provider's uptime commitment covers none of it.

What's Happening

Native recovery is a short retention window

Every major platform keeps deleted items for a while. SharePoint in Microsoft 365 retains them for 93 days from deletion, and Microsoft keeps backups for 14 more days that an administrator can ask support to restore from ⁴. Items can leave the recycle bin earlier if it exceeds its quota or an administrator purges it ⁴. Google Workspace lets an administrator restore a user's Drive or Gmail data for up to 25 days after it leaves the user's trash, and a deleted user account for 20 days; after that, Google says, the data cannot be restored even through technical support ⁵. Salesforce's recycle bin holds deleted records for a limited time and does nothing for records that were changed or corrupted ³.

These windows handle the employee who deletes the wrong folder. They do not handle corruption discovered after the window closes, a sync tool that overwrote thousands of records last quarter, or an attacker who empties the recycle bin on the way out.

The providers sell backup as a separate product

Salesforce once offered a last-resort Data Recovery Service. In 2020 it cost a flat $10,000, took six to eight weeks, did not guarantee full recovery, and was retired on July 31, 2020 because, Salesforce said, it did not meet its quality standards ⁶. Salesforce now offers its own Backup and Recover product ³. Microsoft sells Microsoft 365 Backup as a pay-as-you-go service at a list price of $0.15 per GiB of protected content per month, covering SharePoint sites, OneDrive accounts and Exchange mailboxes ⁷.

Attackers now go after the data and the copies together

Salesforce data theft, 2024 to 2025. The FBI reported in September 2025 that a group it tracks as UNC6040 had, since October 2024, phoned companies' call centers posing as IT support and talked staff into authorizing a modified version of Salesforce's Data Loader tool ⁸. The attackers then used API queries to pull large volumes of customer data for extortion ⁸. A second group, UNC6395, used stolen OAuth tokens from the Salesloft Drift integration in August 2025 until the tokens were revoked on August 20 ⁸. These were thefts, and a backup does nothing to un-steal data. The lesson for this paper is the access involved: an integration trusted to read and write in bulk can delete in bulk.

Storm-0501, 2025. Microsoft Threat Intelligence described in August 2025 a ransomware group that operated entirely inside a victim's Azure environment ⁹. After gaining the Owner role, the group exfiltrated data, then deleted snapshots, virtual machine restore points, storage accounts and Recovery Services vault protection containers ⁹. Where resource locks and immutability policies blocked deletion, it removed the locks and policies ⁹. The environment was Azure, and the pattern carries over to any platform: backups that live under the same administrative identity as the data are deleted with the data.

Microsoft nonprofit subscriptions, 2025 to 2026. Microsoft ended its Business Premium grant for nonprofits after July 1, 2025 and advised affected customers to move plans and export what they wanted to keep ¹⁰. In September 2026 The Register reported that, because of an error, Microsoft had deleted remaining data from expired subscriptions before the retention period ended ¹⁰. Microsoft told one customer the data could not be recovered and that it could not provide a list of what had been deleted, or whether anything had been ¹⁰. The number of organizations affected was not disclosed ¹⁰. Here no attacker and no employee was involved. The provider made the mistake, and the customer had no record of what was lost.

When Google Cloud accidentally deleted the private cloud subscription of the Australian pension fund UniSuper in May 2024, the fund's 647,000 members got their service back largely because UniSuper kept backups with another provider ¹¹. Another paper in this series covers that case.

Most companies have not closed the gap

HYCU, a vendor of SaaS backup, surveyed 500 IT decision makers in 2025. Treat its figures as the sponsor's: 66% believed their SaaS vendors were solely responsible for protecting their data, 43% said nobody owned SaaS data resilience, 87% admitted at least one SaaS application at risk from inadequate protection, and 75% did not test resilience regularly ¹². Respondents used an average of 139 SaaS applications, and only 56% of them were under IT's control ¹².

The standards are plain. NIST's Cybersecurity Framework 2.0 includes subcategory PR.DS-11: backups of data are created, protected, maintained and tested ¹³. The CISA #StopRansomware Guide says to keep offline, encrypted backups of critical data, test them regularly, and consider a second cloud for cloud-to-cloud backups so one vendor's compromise cannot reach every copy ¹⁵. Neither document exempts data because a SaaS provider hosts it.

Why the Usual Approach Fails

Uptime gets mistaken for durability. A provider can meet its availability commitment while a customer's data is deleted, because the platform served every request correctly, including the destructive one.

Replication gets mistaken for backup. Providers copy data across disks, zones and regions so their own failures do not lose it. A deletion or a corrupting sync job replicates in seconds. UniSuper's environment was duplicated across two geographies, and the deletion took out both ¹¹.

The backup sits inside the blast radius. Retention policies, litigation holds and the provider's own backup add-ons usually sit in the same tenant and answer to the same global administrator. An attacker who holds that role, as Storm-0501 did in Azure, can remove the protections before removing the data ⁹.

Restore is never tested at scale. Restoring one file proves little. Tony Redmond, a long-time Microsoft 365 commentator, wrote in September 2026 that no product can yet restore a complete Microsoft 365 tenant after a destructive attack ¹⁴. Recovery means rebuilding identities in Entra ID first, then groups, then the sites and mailboxes that depend on them, one workload at a time, over weeks ¹⁴. Teams, Planner and much of the tenant's configuration still lack full backup or export interfaces ¹⁴. A company that has not rehearsed that order will learn it during the outage.

The long tail is ignored. Microsoft 365 gets a backup because it is visible. The CRM, the HR system, the e-signature archive and the ERP often do not, and a large share of SaaS applications are bought outside IT ¹².

The Framework: Own the Copy, Prove the Restore

The goal is simple to state. For every SaaS platform that holds records you cannot rebuild, you hold a recent copy the provider and your own administrators cannot delete, and you have proved within the last quarter that you can restore from it in a known time.

flowchart LR
    A[Inventory<br/>SaaS holding<br/>critical records] --> B[Set targets<br/>data loss and<br/>restore time]
    B --> C[Copy out<br/>outside the<br/>provider tenant]
    C --> D[Protect<br/>immutable, separate<br/>credentials]
    D --> E[Restore test<br/>quarterly<br/>and timed]
    E --> A

Inventory. List every SaaS platform that holds records the business cannot recreate from another system: mail and documents, customer and pipeline data, contracts and signatures, HR, finance and ERP, code repositories. Include configuration as well as data. A Salesforce org without its custom objects and automation, or a Microsoft 365 tenant without its identities and access policies, will not run even after the records come back.

Set targets. For each platform, the business owner agrees how much data the company can afford to lose and how fast it must be usable again. Those are business decisions, covered in another paper in this series, and they set backup frequency and spend.

Copy out. Back up to storage outside the provider's tenant. That can be a third-party backup service, a second cloud, or your own storage. The copy must not depend on the provider's account remaining open, since account closure and provider error are both causes of loss ¹¹⁰.

Protect. Make the copy immutable for a defined period and hold it under credentials that no everyday administrator, integration or AI agent can use. Require a second person to approve any change to retention. Storm-0501 removed immutability policies because the same identity controlled them ⁹.

Restore test. Every quarter, restore a real sample from each critical platform into a test environment, and once a year rehearse the loss of a whole platform, starting with identities. Record the time taken and what failed. The first rehearsal usually finds something missing, such as permissions, metadata or attachments.

What it costs

Backup is cheap relative to the records it protects. As an illustration, a company with 2,000 employees protecting 20 TiB of Microsoft 365 content at Microsoft's list price would pay about $3,072 a month, or $36,864 a year, roughly $18 per employee ⁷. That figure is the author's illustrative estimate. It assumes 20,480 GiB of protected content, no growth, and list price, and it covers one platform. Third-party tools that also cover Salesforce, Google Workspace and ERP data are priced differently, and the larger cost is staff time for the quarterly restore tests.

Costs, Risks, and Tradeoffs

How to Act

Questions to Ask Your Team

1. Which SaaS platforms hold records we could not rebuild from any other system?
2. For each, where is our most recent copy, and who can delete it?
3. If our global administrator account were taken over tonight, which backups could the attacker reach?
4. When did we last restore more than a single file from Microsoft 365, Google Workspace or Salesforce, and how long did it take?
5. How would we know if a sync tool or integration had been corrupting customer records for three months?
6. Which integrations and AI agents can delete or export data in bulk, and who approved them?
7. If a provider told us our data was gone, could we say what had been lost?

Closing

The SaaS providers have been clear in their terms: they run the platform, and the customer protects the data. Their recycle bins are a convenience measured in weeks. Provider errors and stolen administrator accounts both reach past them. Keep an independent, immutable copy of every SaaS platform that holds records you cannot rebuild, hold it under separate credentials, and prove each quarter that you can restore it.