How to choose a cloud backup service: a 12-point checklist for homes and small businesses

If you're working out how to choose a cloud backup service, the feature lists soon start to look the same: secure, automatic, unlimited. The differences that matter only show up when you need to restore something, which is the worst possible time to find out. This checklist gives you twelve questions to ask any provider, whether you're protecting one home PC or a small business, plus a section on UK GDPR for businesses.

Before you compare: know what you need

Spend five minutes on these first, because they change which answers matter most:

• How much data? Check the size of the folders you'd back up: select them in File Explorer and choose Properties.
• How many devices? Desktops and laptops, and whether they're at home, in the office or both.
• What kind of data? Family photos, client files, accounts, email, anything covered by data protection law.
• How quickly would you need it back? Within hours, or within days? That decides whether you also need a local copy. Our guide to RPO and RTO in plain English helps you answer this.

The 12-point cloud backup checklist

1. Is it really a backup, not just sync?

A backup keeps independent copies and earlier versions; a sync service mirrors changes, including deletions and damage. If a product's main job is sharing files across devices, it's a sync service with some safety-net features. Our guide to cloud backup vs cloud sync explains the difference.

2. Who holds the encryption key?

Everything should be encrypted in transit and at rest. The bigger question is whether files are encrypted on your PC with a key only you hold (zero-knowledge encryption) or with keys the provider manages. Zero-knowledge is more private, but it means nobody can recover your data if you lose the encryption password, so make sure you're comfortable looking after it.

3. How much version history is kept, and for how long?

Ask exactly how many versions of each file are kept, for how long, and how long deleted files stay restorable. "30 versions" means something very different for a file that changes every hour than for one that changes once a month. Look for a mix of frequent recent versions and longer-term daily, weekly or monthly ones.

4. How does it protect against ransomware?

Ransomware deliberately goes after backups. Good answers include immutable storage (stored copies can't be altered or deleted for a set period), automatic protection of the last clean backup when suspicious mass changes are detected, and a clear way to restore everything to a point before the attack.

5. Can it back up everything you need?

Check that it covers all the folders and drives that matter. Ask whether it backs up open or locked files (on Windows this uses the Volume Shadow Copy Service), which matters for Outlook data files, accounting software and small databases. Check for any limits on file size or file types.

6. How easy is it to restore, and how fast?

Restoring is the whole point. Can you restore a single file, a folder, an earlier version, and everything onto a new PC? Can you pick a date and see your files as they were then? Ask how large restores work: downloading hundreds of gigabytes over a home connection takes a long time, which is why some people keep a local copy as well. During any trial, restore something.

7. Does it run itself, and tell you when it doesn't?

The best backup is one nobody has to remember. Look for continuous or scheduled backups, automatic start with Windows, and alerts by email or in the app when a device hasn't backed up for a while.

8. Is it efficient with bandwidth and storage?

After the first backup, only changes should be uploaded. De-duplication (storing identical data once) and compression cut upload times and storage use. Bandwidth limits help if your connection is slow or shared.

9. Where is the data stored?

Ask which country your backups are stored in and whether that can change. For home users it's mostly a question of trust; for businesses it has data protection implications, covered below.

10. How is the account itself protected?

Your backup account is a key to your data. Look for strong sign-in protection, the ability to see and remove devices, and clear control over who in a business can restore or delete backups.

11. Is the pricing clear and predictable?

Compare what you get for your money, not just the headline price: storage, number of devices, version history and support. Check what happens if you run out of storage, what renewal prices are, whether paying annually saves money, and what happens to your backups if you cancel.

12. Who is behind it, and can you leave?

Look for a named company you can contact, clear documentation and a support route that reaches a person. Check how you'd get your data out if you decided to switch; restoring everything to a drive should always be possible.

UK GDPR considerations for businesses

If your backups contain personal data about customers, staff or anyone else, data protection law applies to the backups just as it does to the live data. This isn't legal advice, but these are the areas to think about, and the Information Commissioner's Office (ICO) has detailed guidance on each.

Your backup provider is usually a processor

When a supplier stores personal data on your behalf, UK GDPR generally requires a written contract setting out what it may do with that data, often called a data processing agreement. Ask for it, and check that it covers security, any sub-processors, and what happens to the data when the contract ends.

Security of processing

You must protect personal data with appropriate security, and UK GDPR gives encryption as one example. Encryption on your PC with a key your supplier doesn't hold is a strong measure. The law also refers to being able to restore access to personal data in a timely manner after an incident, which is exactly what tested, versioned backups give you.

International transfers

If backups are stored outside the UK, the transfer rules apply. The UK recognises countries in the European Economic Area as providing adequate protection, so storing data in an EU data centre is generally straightforward from a transfer point of view; storage elsewhere may need extra safeguards. The ICO's guidance on international transfers explains the options.

Retention and erasure

Keep backups only as long as you need them, and know how long your provider keeps deleted data. If you receive a valid request to erase someone's data, the ICO's guidance on the right to erasure explains how backups fit in, including putting backup data "beyond use" until it's overwritten or expires.

Red flags

• No clear answer about where data is stored or who can read it.
• Version history described only as "unlimited", with no explanation of what is kept and for how long.
• No way to try a restore before you commit.
• Vague security claims with nothing specific about encryption or who holds the keys.
• "Unlimited" storage with fair-use limits buried in the terms.
• No company name, address or support route.

For businesses, the backup is one part of a wider defence; our ransomware checklist for small businesses covers the rest.

How EverSafe answers the checklist

So you can see how we'd answer: EverSafe is a backup (not sync) service for Windows 10 and Windows 11. Files are encrypted on your PC with AES-256-GCM, using a key derived from your own password with Argon2id, so we can't read them, and a lost encryption password can't be reset. Version history is hourly for the last day, then daily; plans with unlimited versions also keep weekly versions for a year and monthly versions after that. Stored copies are immutable for 14 days, and suspicious mass changes automatically protect the last clean backup for 30 days.

EverSafe backs up continuously or on a schedule, includes open files through Volume Shadow Copy, uploads only the changed parts of files, and stores backups in an EU data centre. You can restore any version, deleted files, or everything onto a new PC. Plans are priced by storage, with more devices and longer version history on the larger plans; the pricing page has the details, and the features page explains how it all works.