Managed Backup and Disaster Recovery for Ontario Businesses
A backup only matters on the day you need it back. We back up your Microsoft 365, servers and business data, keep copies on-site and in the cloud, watch every backup job, and test restores so recovery works when something goes wrong.
What we back up
Everything your business would struggle to recreate. Most businesses are surprised by how much of it lives in Microsoft 365.
Microsoft 365 email
Exchange Online mailboxes, calendars and contacts, backed up daily. Restore a single email, a folder, or a whole mailbox from an earlier point in time.
OneDrive, SharePoint and Teams
Personal files, team sites, document libraries and Teams data, backed up daily alongside email, so a deleted site or an encrypted library can be rolled back.
Servers
Full image backups of physical and virtual servers, so a failed server can be rebuilt from scratch. An on-premises Exchange server is a server like any other and is protected the same way.
Workstations
Business workstations are part of the plan, so a failed computer does not have to mean lost work.
Line-of-business data
Accounting, practice management, ERP and other business applications and their databases, with application-aware backups so the data restores in a consistent state.
Network configuration
Firewall rules, switch configurations and VPN settings, documented and backed up so the network can be put back the way it was.
Why Microsoft 365 retention is not a backup
Microsoft keeps Microsoft 365 running. Protecting the data inside it is your job. The recycle bin, the deleted items folder and retention policies are useful for "oops, I deleted that", but they are short-term and they sit inside the same tenant that a ransomware attack, a compromised admin account or a bad policy change can reach. Once the window closes, Microsoft cannot get the data back for you.
A real backup is independent of your tenant, lets you roll back to a clean point in time, and keeps data for as long as you decide. Our Microsoft 365 backup data is stored in Canadian data centres. For the full explanation, read how to back up Microsoft 365, or see how backup fits into our Microsoft 365 management.
Archiving is a different job. If old SharePoint files are filling your storage, ClayGen Archive moves them to lower-cost storage. You still need a backup of what stays.
The 3-2-1 rule, and why one copy must be out of reach
The long-standing rule of thumb is 3-2-1: three copies of your data, on two different types of storage, with one copy off-site. That way a single failure, fire, flood or theft cannot take every copy at once.
Ransomware changed the last part. Attackers now go after backups first, because backups are your way out. So at least one copy needs to be out of their reach: stored separately from your network and your everyday accounts, offline, or immutable, which means it cannot be changed or deleted for a set time, even by an administrator. Cyber insurance applications ask about exactly this.
We keep your backups on-site, for fast everyday restores, and in the cloud, so there is always a copy away from your office. Whoever runs your backups, ask them how at least one copy is kept out of an attacker's reach.
Untested backups do not count
A backup job that says "completed" is not proof. The proof is a file you can open, a mailbox you can read, or a server that boots. Many businesses find out their backups were incomplete, out of date or unreadable on the day they need them.
We test restores regularly by pulling data back and checking it works. Insurers increasingly ask whether backups are tested, not just whether they exist, and an answer that does not match what is in place can put a claim at risk. If your renewal questionnaire is due, our cyber insurance application help covers the backup questions and the rest of the form. For what policies cover, read does your business need cyber insurance.
Recovery time and recovery point, in plain words
Recovery time: how long can you be down?
The longest a system can be out before it really starts costing you customers or revenue. IT people call it the RTO.
Recovery point: how much work can you redo?
How far back the last good copy can be. If losing a day of entries would hurt, backups have to run more often than once a day. IT people call it the RPO.
There is no right number for everyone. Tighter targets cost more, so we agree recovery targets with you for each key system, based on what downtime costs your business, and set up backups and restore tests to match. Our guide to business continuity and disaster recovery walks through setting them.
Businesses with more than one location
When each office or clinic runs its own backup, nobody knows which ones are working. We bring every location under one plan: the servers and devices at each site, Microsoft 365 for staff wherever they work, and one place to see backup status across all of them in ClayGen Connect.
The recovery process is the same at every site, so an outage at one location does not depend on who happens to be there that day.
Healthcare and PHIPA-sensitive data
Ontario health information custodians must protect personal health information with reasonable safeguards, and being able to recover patient records after a failure or an attack is part of that. A backup holds the same sensitive data as the live system, so it needs the same care: encrypted, access-controlled, tested, and stored somewhere you can account for.
We handle the IT side. Your privacy officer or lawyer is the right person for questions about your obligations. For more, read PHIPA IT requirements for healthcare or see our IT compliance service.
Recovering from ransomware
Clean, tested backups are what let you recover without paying. But the first step is not restoring. It is stopping the spread, because data restored onto an infected network can be encrypted again. We isolate the affected systems, work with your cyber insurer, and rebuild from clean backups.
Read our ransomware recovery playbook for the first hour, or see how our managed cybersecurity keeps an incident from reaching your backups in the first place.
How we deliver it
Free IT assessment
We look at what is backed up today, what is missing, where the copies live, and whether they restore.
Set up and manage the backups
We deploy and manage automated backups for Microsoft 365, your servers, devices and business data, with copies on-site and in the cloud.
Watch every job
Backup jobs are monitored, and backup success is in your monthly report and visible any time in ClayGen Connect.
Test restores
We test restores regularly, so recovery is proven before you need it, not on the day.
Review recovery targets
We review your recovery targets with you and adjust them as the business changes.
Backup and recovery is included in every ClayGen managed IT plan, alongside monitoring, the help desk and patching, so there is no separate backup bill to forget about. Microsoft 365 backup is also included in our Microsoft 365 management.
Serving Guelph and all of Ontario
We are based in Guelph and look after businesses in Guelph, Kitchener-Waterloo, Cambridge, Hamilton, the GTA, London, Barrie, Niagara and the rest of Ontario. Most backup and restore work is done remotely. When hardware needs hands, such as a failed server, we can usually be on-site within 1 to 2 hours, depending on location.
Backup and Disaster Recovery FAQ
What does ClayGen back up?
Does Microsoft 365 back up my email and files?
Is backup included in ClayGen managed IT?
How does ClayGen know a backup will actually restore?
What recovery time and recovery point will we get?
Can ClayGen centralize backup for a business with several locations?
Can ClayGen back up healthcare data covered by PHIPA?
What should we do if ransomware hits?
Find out if your backups would restore
We will check what is backed up, what is not, and whether it comes back, then tell you plainly what we would change.
Book a Free IT AssessmentLast updated . Page created: what we back up, why Microsoft 365 retention is not a backup, 3-2-1 and isolated copies, tested restores, recovery targets, multi-location, healthcare and ransomware recovery.