How to Choose a UK Offsite Backup Provider and Test Its Claims

Offsite is about fire and theft - ransomware asks a harder question

An offsite copy protects you from losing the building, the server room or the hardware. That matters, but it is the easy half. The harder half is an attacker who has already obtained administrator rights in your environment and goes looking for your backups before they announce themselves. The NCSC says plainly that there have been cases where attackers destroyed copied files or disrupted recovery processes.

So the useful test for any provider is not 'is it in another location?' but 'if someone holds our backup administrator credentials, can they delete or shorten the retention of the offsite copy - and if they can, is there anything behind that which they cannot reach?' Everything else in this article is a way of getting a straight answer to that question, plus the practical ones about getting your data back quickly and affordably.

Offsite, offline, immutable, air-gapped: what each word actually promises

These terms get used as if they were interchangeable. They are not, and a brochure can use one honestly while implying another. Ask for the mechanism behind the adjective.

• Offsite means the copy is in a different location. It says nothing about whether someone with the right credentials can delete it over the network. NCSC's 3-2-1 rule (at least 3 copies, on 2 devices, 1 offsite) does not by itself require any copy to be offline, which is why the NCSC pairs it with a separate offline rule.
• Offline is the NCSC's test of whether, at any given moment, at least one backup is unreachable so that a single incident cannot touch every copy. The NCSC notes you cannot unplug cloud storage, so a cloud copy counts only if it is digitally disconnected when not in use and your backup clients do not hold valid credentials in the meantime. A repository that is permanently online and accepting connections is offsite, but it is not offline in that sense.
• Immutable means the data cannot be changed or deleted for a defined period. The period matters as much as the word: ask how long, who set it, what enforces it (the storage layer or just the backup software) and whether a provider administrator can override it. In Veeam's hardened repository, for example, the immutability period is a per-repository setting, so tenants sharing one repository cannot each have their own, and a tenant's configuration backup sent to a hardened cloud repository does not become immutable.
• Deleted-backup protection is a different thing again. Veeam's Insider Protection moves backup files that a tenant deletes, or that retention removes, into a recycle bin on the provider's repository for a number of days that the provider chooses, then purges them. It is a genuinely useful safety net. It is not immutability, it depends on the provider enabling it for your account, and Veeam documents that it is not available where an object storage repository is assigned as the tenant's cloud repository.
• Air-gapped strictly means there is no network path to the data at all. Very few always-available online services are air-gapped in that strict sense. More often the phrase is shorthand for 'held under separate credentials' or 'in another system', which can still be valuable, but should be described as that. Ask how data gets there, how it is restored, and what physically or logically stops an attacker with your credentials from reaching it.

Where Veeam Cloud Connect fits

If you already use Veeam Backup & Replication, a Veeam Cloud Connect provider is often the lowest-friction way to get an offsite copy. Veeam describes Cloud Connect as two services that providers may offer separately. Cloud Connect Backup gives you a cloud repository: storage in the provider's infrastructure that holds backups of your machines and can serve as a primary or secondary location. Cloud Connect Replication is a disaster recovery service, where the provider supplies compute, storage and network resources so you can fail over to VM replicas running in their environment.

Those are not the same purchase. A repository holds backup files that you restore from. Replication gives you somewhere to run workloads while you recover. If a quote says 'Cloud Connect' without saying which, ask. For most small businesses buying an offsite backup it will be a repository, which means your local backup remains your fast route to recovery and the cloud copy is the one you need when the local one is gone. Our guide on connecting Veeam to a Cloud Connect provider covers the local-backup-then-backup-copy pattern and the setup in detail, so we will not repeat it here.

Two Cloud Connect specifics are worth putting to any provider. First, which Veeam version they run and how quickly they upgrade, because tenant and provider versions have to stay compatible (our guide notes that a tenant cannot run a newer version than the provider). Second, whether Insider Protection or a hardened repository is in use and, if so, for how many days or what period, because Veeam leaves both decisions to the provider.

Where the data lives and who can reach it

'UK cloud' can mean a UK data centre, a UK-registered company, or UK support staff, and these are not the same. The NCSC's cloud security guidance says you should know where your data is stored, processed and managed and who can access it, including derived data such as logs. It suggests asking the provider for a full list of countries involved and requiring contractual notice of changes. Remote access from abroad by a support engineer is worth asking about specifically.

Backups of business systems almost always contain personal data, which makes the provider a processor under UK GDPR. The ICO's guidance on processor contracts expects the contract to cover security measures, no sub-processors without your authorisation (with notice and a chance to object to changes), assistance with breach and security obligations, audit and inspection rights, and secure deletion or return of your data when the contract ends. Where data or access goes outside the UK, transfers may need an adequacy decision or other safeguards. Check the current ICO international transfers guidance, and take legal advice if your data is sensitive or regulated.

On assurance, the NCSC points to recognised standards (it names CSA CCM and ISAE 3402 alongside ISO/IEC 27001) and says to check that the certification scope covers the services and regions you will actually use. A logo on a website does not tell you that. Ask for the certificate, the scope statement and the date, and ask which of those apply to the backup platform rather than the company's head office.

Encryption and who holds the keys

There are two different promises that both get called 'encrypted'. One is the provider encrypting data on their storage and on the wire, which protects against someone stealing a disk or sniffing a connection. The other is you encrypting the backup before it leaves your network, so the provider only ever holds ciphertext. With Veeam you control the second by enabling encryption on your jobs. Veeam documents that, if the repository is lost or compromised, backup data cannot be accessed without the encryption password.

That protection comes with an obligation. If the password is lost, so is the backup. Store it somewhere that does not depend on the systems being protected, and find out in advance whether Veeam Backup Enterprise Manager's password loss protection is available to you, because it has to be enabled before you need it and requires a paid licence. Recent Veeam versions (13.1 and later, for both tenant and provider) also let a tenant choose whether a provider can restore on their behalf: none, unencrypted backups only, or all backups, with the password released to the provider's server and used only in memory. Whether you want that convenience is a trade-off between speed of assisted recovery and how many people can read your data. It should be your decision, not a default.

Encryption protects confidentiality, not availability. It does not stop anybody with the right rights deleting a backup. Also, encrypted data deduplicates poorly, which can raise the storage you consume and therefore the price. Ask what happens to keys and data at contract end, too: who deletes what, and how you can verify it.

RPO, RTO, bandwidth and what a restore will cost

Two numbers describe whether a backup will meet your needs. Recovery point objective (RPO) is how much recent data you can afford to lose. Recovery time objective (RTO) is how long you can afford to be without the system. A provider rarely controls your RPO: it is set by how often your jobs run and how quickly each copy reaches the offsite repository. Be wary of a provider quoting an RPO for your data. They can quote how fast they accept it, which is useful, but not what you will lose.

RTO is where offsite backups usually disappoint. Time to restore includes noticing the problem, deciding to restore, pulling the data back, rebuilding the systems and checking them. The download alone can dominate. As arithmetic rather than a prediction: 1 TB is 8 trillion bits, so at a perfectly sustained 100 Mbps it takes roughly 22 hours, before overhead, contention or any throughput limits on the provider's side. Do the same sum with your total protected data and your real upload and download speeds, then ask what the provider can do if that figure is unacceptable, such as faster seeding, assisted restores, shipped media or hosted recovery capacity. Don't assume that every Veeam restore method works from a cloud repository. Check the current Veeam documentation and ask the provider to demonstrate the one you intend to rely on.

Then ask about cost, because the restore is the one time you will use the service in anger. Are there charges for restoring or downloading data, for provider-assisted restores, or for leaving? Is the quota counted against your source data size or the stored size? (Our guide notes that Cloud Connect quota counts against source size, so it can fill sooner than expected.) How are retention periods, GFS (grandfather-father-son) long-term restore points and any deleted-backup recycle bin storage treated in your quota and in the price?

Proof, support boundaries and comparing quotes fairly

Claims are cheap. The NCSC's guidance is to regularly test that backups work as expected, to scan backups for malware before restoring and to reconnect them only to known clean devices before recovery. A useful acceptance test follows that. Restore from the offsite copy, not the local one. Restore to different hardware or a clean virtual machine, as if the original had gone. Time it end to end, check that the application opens and the data is current, and record who did what and what went wrong. Include the encryption password retrieval from wherever you said it would be. If the restore needs the provider, note how long they took to respond.

Test the deletion protection by asking, not by deleting. Ask the provider to explain what happens when a backup is deleted or a retention policy is shortened on your account, who can reverse it, and for how long. If they can show evidence from a test tenant, good. Do not experiment on your only copy of production data.

Support boundaries decide whether a good platform is a good service. Find out what is included at 2am on a Sunday: access to a human, assistance with Veeam itself or only the storage, and whether anyone helps you rebuild or just hands the data back. If there is no contractual support, there is no guaranteed support.

Finally, make quotes comparable before comparing prices. Put each on the same footing: the same protected data and growth, the same retention including long-term points, quota basis (source or stored), whether Veeam licensing or agents are included, restore and exit charges, minimum term, VAT and support hours. Then work out the cost per terabyte per month on that footing. A cheap headline rate with restore charges and a thin retention allowance is not cheap. The NCSC also notes that public SLAs are generally stronger commitments than contract-only terms, and that an SLA usually covers a single service. An uptime figure for a web portal says nothing about how fast you will get your data back.

Where Rismor exoVault fits - and what its page does not say

We offer exoVault, so you should weigh this section accordingly and hold us to the same questions as everyone else. exoVault is a Veeam Cloud Connect backup repository with your own storage quota. It can take backups from existing Veeam, Veeam software and licensing supplied by Rismor, or compatible Veeam backup agents. It is a repository service, not Cloud Connect Replication. On top of the repository, our product page describes storage-level snapshots and replicas of that repository, held in separately controlled storage outside your account and quota, with independent administration and credentials. Both layers are included as standard. Restores use your own encryption keys, and there is a web portal to monitor protection and manage backup jobs.

What that page does not currently state matters just as much. It does not describe data centre locations or jurisdiction, snapshot or replica retention periods, immutability, an air gap, certifications, an uptime or recovery SLA, pricing or restore charges, quota sizes, or support hours. 'Separately controlled' describes administrative separation. It should not be read as an air gap or as immutability, and nothing on the page says Insider Protection is enabled on tenant accounts. Treat anything you cannot find in writing as unconfirmed and ask us for it. We would rather be asked than assumed.

If you are comparing exoVault with another provider, use the questions below with both.

Procurement questions to send before you sign

Copy these into your request. A good provider will answer them in writing without fuss. Vague answers are information too.

• Is this a Cloud Connect repository, replication, or something else? Which product versions does the provider run and what is the upgrade policy?
• Which countries host the primary data, any other copies and the management plane? From which countries can support staff access it? Who are the sub-processors and how will we be told about changes?
• Which certifications cover the backup service itself, with what scope and what dates? Can we see the certificate and scope statement?
• Can anyone with our backup credentials delete the offsite copy or shorten retention? If so, what sits behind that which they cannot reach?
• If you claim immutability, for what period, enforced by what, and can your own administrators override it? If you claim an air gap, what is the actual barrier and how does data move across it?
• Is deleted-backup protection (Insider Protection or equivalent) enabled for our account, for how many days, and who performs a recovery from it?
• Who holds the encryption keys? Can you ever decrypt our data? What happens if we lose the password?
• What are the retention limits, including long-term points, and how does the quota count them? Is it measured on source or stored size?
• What are all the charges for restore, assisted restore, early termination and data return at exit? Are there minimum terms?
• What restore options exist if our download speed is too slow? Will you demonstrate the restore method we plan to rely on, from our own test data?
• What do you commit to in writing for availability and support response, and does that cover restores or only the portal? What is outside support?
• How is our data deleted at the end of the contract and how do we verify it?