Layer 04 · Operate · Subscription
Backup-as-a-Service (BaaS)
Backup-as-a-Service (BaaS) is a managed subscription in which STP runs your backups to the 3-2-1-1-0 rule (three copies, on two different media, one offsite, one immutable or offline, and zero errors when restores are verified) using Veeam, Commvault or open-source tools, and proves the backups by restoring from them.
Overview
A backup is only as good as the last restore that worked. Most backup failures are discovered on the day of the restore: the job that has been failing quietly for weeks, the copy that sat on the same storage the ransomware encrypted, the restore that takes far longer than anyone assumed.
We run backup to the 3-2-1-1-0 rule. Three copies of the data, on two different types of media, one of them offsite, one of them immutable or offline so that an attacker holding administrator rights cannot delete or encrypt it, and zero errors when the backups are verified by restoring them. The last two numbers are the ones most backup estates are missing.
The offsite copy goes where your obligations allow: STP's partner data centre in Armenia, a facility certified Tier III by the Uptime Institute, when the data has to stay in the country, or AWS, Google Cloud or Azure when it need not. We operate Veeam, Commvault, or open-source tools such as Bacula, Bareos, restic and BorgBackup, chosen against what is being protected rather than to fit a single product.
Retention follows the grandfather-father-son (GFS) scheme. Point-in-time recovery where the system supports it, then 24 hourly restore points, 7 daily, 4 weekly, 12 monthly, and 3 or 5 yearly, as your requirements set. Microsoft 365 is covered as well, because the retention Microsoft provides is not a backup you can restore from after a deletion or an attack.
You see the evidence: which jobs ran, which restores were tested, and what failed and was fixed. That record is also what an auditor asks for.
What is included
- Backup design against the 3-2-1-1-0 rule
- Veeam, Commvault, or open-source software such as Bacula, Bareos, restic and BorgBackup, operated by STP
- An immutable or offline copy that administrator credentials cannot delete
- Offsite copy in STP's Tier III certified partner data centre in Armenia, or in AWS, Google Cloud or Azure
- Job monitoring, with failures followed up rather than silently retried
- A restore test once a year by default, verifying the data and not just the job status, with more frequent testing available as a paid addition
- GFS retention: point-in-time where possible, then 24 hourly, 7 daily, 4 weekly, 12 monthly and 3 or 5 yearly restore points
- Microsoft 365 backup, alongside your own systems
- Backup and restore-test evidence for auditors
What you get out of it
- A backup copy that ransomware with administrator rights still cannot reach
- Restores proven before you need one
- Evidence of backup and restore testing when an auditor asks
Technologies we deliver it with
- 3-2-1-1-0
- GFS
- Veeam
- Commvault
- Bacula
- Bareos
- restic
- BorgBackup
- 365
- Google Cloud
- Azure
Named to describe what we work in. Not a claim of partnership, endorsement or certification.
Questions
- What is the 3-2-1-1-0 backup rule?
- Keep three copies of your data, on two different types of media, with one copy offsite and one copy immutable or offline, and verify the backups until restoring them produces zero errors. It extends the older 3-2-1 rule with the two protections ransomware made necessary: a copy an attacker cannot alter, and proof that the backups actually restore.
- Can our backups stay in Armenia?
- Yes. The offsite copy can be kept in STP's partner data centre in Armenia, which is certified Tier III by the Uptime Institute, when data residency requires it. Where it does not, a region in AWS, Google Cloud or Azure is also an option.
- How long are backups kept?
- Retention follows the grandfather-father-son (GFS) scheme: point-in-time recovery where the system supports it, then 24 hourly restore points, 7 daily, 4 weekly, 12 monthly, and 3 or 5 yearly, depending on your recovery and regulatory requirements.
- How often are restores tested?
- Once a year by default, as part of the subscription. Testing more often is available as a paid addition, agreed with you for the systems that warrant it.
- Does Backup-as-a-Service cover Microsoft 365?
- Yes. Microsoft provides service resilience and limited retention, not a backup you can restore from after a deletion or ransomware event outside those windows, so Microsoft 365 is backed up under the same rules as the rest of your data.
- How is Backup-as-a-Service priced?
- As a monthly subscription. The fee depends on the setup and architecture, the functionality you need, and the volume of data protected, so it is sized against your systems rather than quoted from a list.
- What service levels do you commit to?
- They are agreed per client rather than fixed in a catalogue. Response times, coverage hours and reporting are tuned to what your systems and obligations require, and written into the subscription.
- Is backup the same as disaster recovery?
- No. Backup lets you restore data after it is lost or damaged. Disaster recovery brings whole systems back to running within an agreed time. Backup is part of disaster recovery, not a substitute for it, which is why Disaster-Recovery-as-a-Service is a separate service.
Standards and references
Talk to an engineer about Backup-as-a-Service (BaaS)
A live engineer calls you back within 1 hour.