Backup and data encryption — what to ask your provider
A backup that isn't properly encrypted can turn into a weak point in your data protection on its own. Here are the questions worth asking before you pick a provider.
What to ask
Is data encrypted in transit
Ask whether your data is protected while it travels from your computer to the provider's servers. Without that, someone intercepting network traffic could in theory see the contents of files as they're being sent.
Is data encrypted once it's stored
That's separate from encryption in transit. Ask whether files are also encrypted "at rest" — while sitting on the provider's own disks. That protects your data even if hardware were ever physically stolen from a data center.
Who holds the encryption key
Ask whether only your business holds the key needed to decrypt the data, or whether the provider does too. If the provider holds the key, their staff could in theory access the contents of your files.
What happens if the password or key is lost
Ask what happens if the business forgets its password or loses access to the account. Strong encryption with no recovery path can be just as much of a problem as having none at all — better to know this up front.
Why this isn't just a technical detail
A backup often holds the same sensitive data you protect day to day — contracts, customer records, invoices. If the backup itself isn't properly secured, it becomes another place that data could leak from, instead of purely a safety net for when something goes wrong.
When it's a job for IT
- You're not sure whether the business's current backup is encrypted at all, or at which stage.
- You're negotiating a contract with a backup provider and need help assessing their answers to these questions.
- The business handles customer personal data and you need assurance the backup meets data protection requirements.
Not sure whether your backup is properly secured?
Report the issue — it goes straight into our ticketing system, and our AI assistant assesses priority right away.