Contents
A backup plan starts from two thresholds: the maximum acceptable data loss (RPO) and the maximum acceptable downtime (RTO). France’s cybersecurity agency recommends three copies of the data on two different media, one of them offline, and regularly tested restores. A backup that has never been restored is not a backup.
A database deleted by mistake, a hacked admin account, ransomware, a host outage: the day your business tool stops, the question is no longer “do we have backups?” but “how long until we are back up, and with what data?” Here is the method I use to answer that before the incident, based on the recommendations of ANSSI, France’s national cybersecurity agency.
Two thresholds to set first
In its guide The fundamentals of information system backups (in French, version 1.1 dated November 27, 2025, checked October 27, 2026), ANSSI says the strategy should rest on two values, defined for each business activity:
- the recovery point objective (RPO): how many hours of data entry can you lose without serious harm?
- the recovery time objective (RTO): how long can you work without the tool?
These two numbers are management decisions, not technical choices. They are set with the business managers, by asking what a day without the tool costs, or half a day of orders to re-enter.
| Tool profile | Acceptable data loss (RPO) | Acceptable downtime (RTO) | Suitable setup |
|---|---|---|---|
| Internal tool used occasionally | 24 hours | 2 to 3 days | Daily backup, external copy, written procedure |
| Management tool used every day | A few hours | 1 day | Daily backup + fine-grained restore, external copy, tested restore |
| Critical tool (orders, production, client portal) | Under an hour | A few hours | Point-in-time restore, replication, offline copy, rehearsed recovery plan |
These profiles are illustrative examples: your thresholds depend on your business. ANSSI notes that when the acceptable loss drops below 24 hours, replication becomes more suitable than backups alone.
The 3-2-1 rule and the offline copy
ANSSI’s guide recommends:
- three copies of the data: production plus two backups;
- two different media;
- at least one offline copy, disconnected from the information system, even if it is made less often.
The offline copy protects against the most feared scenario: an attacker who gains admin access and encrypts or deletes both production and the online backups. ANSSI also recommends named, dedicated admin accounts for backups, separate from those used for production.
What the host actually does
The backups included in hosting plans are a good starting point, but you have to read what they cover. Take Supabase, which I often use for the database, based on its backup documentation checked October 27, 2026:
- paid plans include an automatic daily backup, kept for 7 days on the Pro plan, 14 days on the Team plan and up to 30 days on the Enterprise plan;
- point-in-time recovery is available as a paid add-on, billed monthly based on the retention period;
- the database backup does not include files stored through the storage service (documents, photos).
In other words: without an extra copy, an error discovered after ten days on the Pro plan can no longer be recovered, and attachments are not covered by the database backup.
The recovery plan: written, short, tested
A backup with no restore procedure is of little use on the day. The recovery plan fits in a few pages:
- who decides to trigger recovery and who carries it out, with up-to-date contact details;
- where the backups are and how to reach them if the main account is compromised;
- the restore steps, in order: database, files, configuration, checks;
- degraded mode: how the team keeps working during the outage (a recent export, a paper procedure);
- communication to users and, if personal data is affected, assessing whether the breach must be reported (see GDPR and business apps).
The GDPR asks for this too: Article 32 of Regulation (EU) 2016/679 lists, among security measures, the ability to restore the availability of and access to personal data in a timely manner after an incident. ANSSI stresses regular restore tests. I recommend at least one real test a year, plus one after every major change to the data structure.
When a heavy setup is not justified
I will be straightforward: for an internal tool where a day of downtime blocks nobody, a daily backup from the host, a weekly export to another account and a restore procedure tested once are enough. Paying for minute-level recovery or two-site replication only makes sense if losing a few hours of data or half a day of downtime really costs you. The setup should follow the thresholds you set, not fear.
How I build it into a project
- During scoping: setting the two thresholds with you, choosing the hosting (see hosting your data in France or the EU).
- During development: automatic backups, an independent copy, file backups, separate admin accounts.
- At go-live: a first restore test and a written recovery plan, handed over with the access credentials.
- Afterwards: periodic tests as part of maintenance (see how much app maintenance costs).
These elements are part of every business app I deliver. For an existing tool, the technical audit covers the database and backups among other areas. To estimate a new project, use the estimator.
Frequently asked questions
Is the host’s backup enough?
Rarely on its own. It protects against hardware failure, but it is often tied to the same account as production: a handling error, a compromised account or a dispute with the host can take out both. An independent copy, on another account or with another provider, completes the setup.
How often should we test a restore?
At least after every major change to the app and at least once a year, by actually restoring the data into a test environment. Measure the time it takes along the way: it has to fit within your acceptable downtime.
How much does a backup plan cost?
Setting it up is part of the development project. Storing the copies adds to hosting, which the client pays for. Fine-grained restore options at the host (down to the minute) cost more: they only make sense if losing a few hours of data is a real problem.
Are files uploaded to the app backed up with the database?
Not always. With some hosts, the database backup does not include files stored separately (PDFs, photos, attachments). Check it, and plan a dedicated copy if needed.