How do I check how a SaaS company handles its nightly data backups?

Start with scope. Does the backup include the main database, uploaded files, settings and the code itself? Ask for the written schedule and the logs of recent runs, including any that failed. Look for gaps and ask what was done about them.

Where the copies live matters. A backup stored on the same server or account as the live system can disappear with it. Ask whether copies are kept elsewhere, whether they are encrypted and who holds the keys. Check who can delete them, since an attacker or a mistake could remove both the live data and the copies.

The key test is a restore. Ask for the date of the last full restore, what it proved and how long it took. Better still, ask the company to do one while you watch, on a safe copy. Then ask what the company would do if it lost a day of data, and how customers would hear about it. If the product holds personal information, ask your lawyer what to report after a breach, and check the cost of backup storage in the statements. Notice also who is responsible each day. If the answer is one person and no alerts exist, the backup can fail for weeks unnoticed, so ask how failures are reported and who reads those messages.

Key takeaways

• Ask for recent backup logs, including failures.
• Confirm copies live in a separate account and are encrypted.
• Ask for a restore test, ideally done in front of you.