Microsoft says they back up M365, don't they?
+
Not really, they keep deleted things for a short while, which is not the same as a backup. Microsoft's own terms are clear: they promise the service stays up; protecting your data inside it is your job. Deleted emails and files are only kept for days or weeks. A proper separate backup keeps your data for years, lets you wind back to any point in time, and can't be touched by ransomware.
What happens if we get ransomware?
+
We go back to a clean version from before it hit. Backups are sent to servers in the cloud, encrypted, and kept as versions over time. So if files get scrambled, we restore the last good copy rather than the damaged one. We've done it for clients, and for whole servers.
How long would it take to recover from a full outage?
+
It depends on how much data, and how much downtime you can afford. Deleted files come back quickly. Rebuilding a large server with complex software takes longer, as the backup has to download and restore onto a new server, local or hosted. A local backup speeds this up a lot. We plan the recovery with you up front, and can run a disaster recovery test (normally charged).
Where are the backups stored?
+
In the cloud, encrypted, and normally on a local backup in your office too. The cloud copy protects you from fire, flood or theft. The local copy makes big restores much faster.
Can staff restore their own files?
+
No, restores go through us, and that's deliberate. Letting everyone reach into the backup is exactly how accidents (and ransomware) spread. If you need something back, you ask the helpdesk and we restore it for you. One less thing for your team to get wrong.