RXed AI News

The 3-2-1 backup strategy: your business data survives the worst day

Encrypted, deduplicated backups to your own drives and cloud — no per-machine subscription

The one blueprint you hope you never need — and the one you will be grateful for when the day comes. A practical, verified backup setup for a small business that already runs its own tools, costs almost nothing, and follows the rule every IT professional has quietly trusted for thirty years.

The problem

Every other blueprint in this library puts your data on a small server you own — bookings, invoices, receipts, passwords, meeting recordings. That server is now a single point of failure, and so is the laptop you manage it from. Drives fail. Someone deletes the wrong folder. A ransomware strain encrypts everything and asks for €2,000 in Bitcoin. The businesses that survive these events are the ones with a backup they tested before they needed it. The ones that don't are the ones who thought "it won't happen to us" — right up to the morning it did. Off-the-shelf backup services charge €10–40 per machine per month, hold your data on their servers, and stop working the day you stop paying. The free alternatives built into your operating system back up to one place — usually a drive sitting next to the computer it is protecting, which dies in the same power surge.

The architecture

Two tools, one strategy. Kopia handles the files you can see — documents, photos, exports — through a desktop app with a graphical interface. Restic handles the server side — Docker volumes, database dumps, configuration files — through a command-line script that runs on a schedule. Both encrypt everything before it leaves the machine, both deduplicate so you are not paying to store ten copies of the same file, and both let you restore from any point in time, not just the latest snapshot.

Tool choices — and why

Kopia (Apache-2.0, 13.7k stars, active — last push 14/07/2026, latest v0.23.1) is the default pick for the non-technical user. It ships with KopiaUI, a desktop app for Windows, macOS and Linux that looks like any other backup software: you pick folders, you pick destinations, you click "snapshot now" or let it run on a schedule. No command line, no YAML files, no SSH. It supports every storage backend worth using — local drives, network shares, Backblaze B2, Amazon S3, Google Drive, OneDrive, SFTP — and switches between them with a dropdown. The encryption is client-side and on by default; the storage provider sees encrypted blobs, never your filenames or contents.

Restic (BSD-2-Clause, 35k stars, active — last push 10/07/2026, latest v0.19.1) is the server-side choice. It is a single Go binary with no dependencies — download it, run it, done. It does not have a GUI, and for server backups that is a feature: you write a five-line script, put it in cron, and it runs silently for years. Restic is what you use to back up the Docker volumes from your other blueprints — the paperless-ngx archive, the Invoice Ninja database, the n8n workflows, the Vaultwarden data — to the same cloud storage provider, in a separate repository. It handles incremental backups natively (only changed blocks are uploaded), verifies repository integrity on every run, and can prune old snapshots on a retention schedule you define.

BorgBackup (BSD-3-Clause, 13.5k stars, active — last push 14/07/2026, latest v1.4.4) is the alternative if your server runs Linux and you prefer Python over Go. It is the oldest of the three, the most battle-tested, and has the strongest deduplication — useful if you are backing up many similar files (daily database dumps, for instance). Two honest caveats: no GUI (CLI only, like Restic), and Borg repositories are not portable across storage backends the way Restic repos are. Borg talks to SSH targets; Restic talks to anything that speaks S3. For most small businesses running cloud storage, Restic is the simpler fit. Borg is the pick if you already have a secondary Linux machine or NAS to act as a backup target over SSH.

Monthly cost. Software: €0 for all three. Local drive: a one-time €30–80 for a USB drive or a pair of them. Cloud storage: the real variable, and it is small. Backblaze B2 charges roughly €0.005/GB/month — 100 GB of business data lands around €0.50/month, 500 GB around €2.30. Most small businesses fit comfortably in the €1–5/month range. If you already run a VPS for the other blueprints in this library, Restic can back up to a Hetzner Storage Box (€1.30/month for 20 GB, €3.70 for 100 GB) or the same Backblaze B2 bucket. Total: €0–5/month ongoing, plus a one-time drive purchase.

Setup outline

1. Install KopiaUI on your main business laptop or desktop. Pick the folders that matter: documents, accounting exports, your browser profile, your password vault export if you keep one.
2. Connect two storage destinations: a local USB drive (copy 1) and a cloud provider (copy 2). Backblaze B2 is the cheapest reputable option; set up an account, generate an application key, paste it into Kopia. The connection is encrypted on your machine before anything uploads.
3. Set a snapshot schedule. Twice daily is plenty for most files; Kopia also snapshots on file changes if you enable it. Keep at least 30 days of daily snapshots and 12 monthly snapshots — Kopia's retention policy handles this automatically.
4. Test a restore now. Pick a file, delete a copy, restore it from Kopia. If you cannot restore, the backup does not exist. This step takes five minutes and is the one most people skip.
5. On the server: install Restic (one binary download), initialise a repository in your cloud bucket with a strong password you store in your password vault, and write a short script: dump databases → restic backup → restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 12 → restic check. Put it in cron at 02:00.
6. Add a database dump step before the Restic backup. For PostgreSQL: pg_dump; for MySQL/MariaDB: mysqldump; for SQLite (used by many of the tools in this library): copy the .db file while the service is briefly paused or use the backup API if the tool offers one.
7. Test the server restore too: spin up a temporary container, restore the latest snapshot, confirm the data is there. A backup you have never restored from is a hypothesis, not a backup.
8. Add a third copy for critical data: either a second cloud provider (Wasabi, iDrive E2) or a physical drive you rotate to a different location weekly. This is copy 3, and it is what turns "good backup" into "survives a fire".

Pitfalls — the real ones

The untested backup is no backup. This is not a platitude — it is the most common failure mode in real businesses. The backup runs for months, the green checkmarks appear, and on the day you need it the repository is corrupt, the password is wrong, or the restore command silently fails because a path changed. Restore-test within 24 hours of setup, and then quarterly. It takes ten minutes.
Ransomware encrypts the backup too. If your USB backup drive is permanently mounted, ransomware on your laptop will encrypt the backup files along with everything else. Disconnect the drive between backups, or rely on cloud storage where old snapshots are immutable — Restic and Kopia snapshots cannot be modified, only new ones added.
Forgetting the database. Backing up the files of a running database (the .db file, the data directory) while the database is writing to it gives you a corrupt copy. Always dump first, then back up the dump. This is step 6 above, and it is the step people forget until they restore a database that will not open.
The 3-2-1 rule is not optional decoration. One copy on your laptop is not a backup. Two copies on the same machine is not a backup. A copy on a USB drive plugged into the same machine is not a backup — it dies in the same event. Three copies, two different media, one off-site. If you only do two things from this blueprint: cloud storage (off-site) and a local drive (fast recovery). The third copy is insurance for the insurance.
Cloud storage keys are credentials. The Backblaze B2 or S3 key that can write to your backup repository can also delete it. Store it in your password vault, not in a plain text file on the desktop, and use app-specific keys with the minimum permissions Kopia or Restic needs.
Retention too aggressive. If you keep only 7 daily snapshots and notice a corruption that started 10 days ago, you are out of luck. Keep 30 daily, 4 weekly, 12 monthly as a baseline. Storage is cheap; regret is not.

Verified repos

Kopia — Apache-2.0, 13.7k stars, active (July 2026), v0.23.1
Restic — BSD-2-Clause, 35k stars, active (July 2026), v0.19.1
BorgBackup — BSD-3-Clause, 13.5k stars, active (July 2026), v1.4.4