Many contractors assume that data in cloud applications is automatically backed up. In a sense it is: vendors run resilient infrastructure and keep their own backups for disaster recovery. But those backups protect the platform, not necessarily your ability to recover a project folder someone deleted, a database corrupted by a bad integration, or an account an attacker took over.
This post explains the shared-responsibility idea and how to plan for the cloud data your business depends on, including project management, accounting, and email.
The shared responsibility model
Most cloud providers describe a split of duties. The provider is responsible for keeping the service running and secure at the infrastructure level. The customer is responsible for their own data, their users, and their access settings. In practice that means:
- If an employee deletes records, the platform may or may not be able to restore them, and for a limited period.
- If an attacker steals credentials and deletes or alters data, the platform sees authorized activity.
- If your contract ends or your account is suspended, you may need your own copy of the data.
- If a connected application misbehaves, it can overwrite good records.
Review your vendor agreements and support documentation to learn what retention, recovery, and export options are offered. Do not guess.
Identify your critical cloud data
List the cloud systems that hold records your business cannot afford to lose.
- Project management and document control: drawings, RFIs, submittals, daily logs, photos, punch lists, meeting minutes.
- Accounting and job costing: general ledger, payroll, job cost, change orders, billing, vendor and customer records, whether hosted by the vendor or in a cloud-hosted instance.
- Email and files: Microsoft 365 mailboxes, SharePoint, OneDrive, Teams.
- Estimating and scheduling tools.
- HR and safety records: training, certifications, incident reports.
Rank them by impact if lost, and by how difficult they would be to recreate.
Understand what the platform offers
For each system, ask your vendor or check documentation:
- How long are deleted items recoverable?
- Is there version history, and how long is it kept?
- What export tools exist, and in what formats?
- Can data be exported in bulk through an API or scheduled report?
- Does the vendor offer or recommend a backup partner?
- What happens to your data at contract end?
Choose a backup approach
Options vary by application.
Third-party backup services
For widely used platforms such as Microsoft 365, several services back up mailboxes and files to independent storage. These are typically the simplest route for email and document storage.
Scheduled exports
For applications without a dedicated backup tool, schedule regular exports of key data, such as project documents, cost reports, and ledgers, to storage you control. Document the process so it survives staff turnover.
Database-level backup for hosted accounting
If your accounting system runs on servers you or your provider manage, back up the database and application with the same rigor as other servers, including offline or immutable copies.
Protect the backups
Exports sitting in a shared folder with broad access are a liability. Store them in an access-controlled location, encrypt them, and keep at least one copy separate from your primary environment. Backups often contain complete financial and project records and deserve the same protection as the originals.
Test recovery
Having an export is not the same as being able to use it. Periodically open exports and confirm they are complete. Ask what it would take to rebuild a project record from them and how long that would take. For critical systems, ask your vendor how restoration of a deleted item works and who must request it.
Reduce the chance of loss
- Restrict who can delete or bulk-edit records.
- Require multi-factor authentication for administrators and all users.
- Review third-party integrations and remove those no longer needed.
- Keep audit logs enabled and review them after unusual events.
- Set retention settings deliberately instead of accepting defaults.
Write it down
Create a simple register listing each cloud system, what it holds, the owner, the backup method, the frequency, and the last test date. Review it twice a year.
How Ironfield Cyber helps
Ironfield Cyber helps contractors and energy companies map cloud data, select backup tools, and test recovery. If you are unsure what would happen if a key project record vanished tomorrow, we can help you find out safely.