Backup and recovery
Some links on this page are affiliate links: we may earn a commission at no extra cost to you. Our approach
Backup is what turns a disaster into an incident. It is judged on one criterion: the real ability to restore quickly and correctly, in a situation where time has already been lost. ## 3-2-1: the basic rule Three copies, two media, one off-site. This simple, memorable rule is the universal foundation: it protects against a server failure, accidental deletion and ransomware that encrypts everything it finds. ## RPO and RTO The RPO is the amount of data loss you accept; the RTO is the time needed to resume activity. Your backup budget follows from these business choices. ## Testing, the only proof A restoration that has never been tested is illusory. The procedure must be written, timed and run regularly on a separate environment.When this guide is for you
- You host an e-commerce site, an application or customer data essential to the business
- You have already lost files or a database
- An update or migration is coming and you want a safety net
- Your backups exist but have never been restored
- A provider stores your data and you need to know how it is protected
Step by step
- Inventory of what must be protected — List critical data: database, site files, images, emails, accounts, infrastructure settings. Rank by impact of losing it over an hour, a day or a week.
- Defining RPO and RTO — Choose the RPO (acceptable data loss) and the RTO (maximum recovery time). For an active e-commerce site, an RPO of 1 to 6 hours is often necessary.
- 3-2-1 strategy — Three copies, two types of media, one off-site copy. A backup on the same server protects against neither a hardware failure nor a global deletion.
- Automation and encryption — Schedule backups automatically, encrypt storage and manage access keys safely. Date the copies and keep them according to a defined retention.
- Restoration tests — Restore regularly to a test environment, note the duration and correct the procedure. An untested backup is an assumption, not a protection.
What it costs (in MAD)
| Service | Indicative price | Good to know |
|---|---|---|
| Cloud storage for backups | 1,000 – 8,000 MAD / year (≈ 90 – 730 €) | Depending on volume and retention |
| Setting up a strategy | 3,000 – 20,000 MAD (≈ 270 – 1,800 €) | Scripts, automation, encryption and documentation |
| Tested restoration (procedure) | 2,000 – 8,000 MAD (≈ 180 – 730 €) | Restoration plan and simulation |
| Managed monthly backup | 500 – 3,000 MAD / month (≈ 45 – 270 €) | Monitoring, checks and on-demand restoration |
| Recovery after an incident | 5,000 – 30,000 MAD (≈ 450 – 2,800 €) | Depending on complexity and the age of the backups |
Indicative ranges for the Moroccan market in 2026, excluding tax. Prices vary with scope and provider.
Mistakes to avoid
- Keeping the backup on the same server as the site
- Never testing restoration
- Backing up without defining the interval: an active e-commerce site often risks losing more than a day of orders
- Leaving unencrypted copies on exposed media
- Forgetting data that is not in the database: imported files, external storage, accounts
Frequently asked questions
How often should you back up?
It depends on the business. For an active shop, a backup every 1 to 6 hours is reasonable. For a brochure site, a daily version is enough. What matters is knowing the accepted RPO.
Does my host not already back up?
Often yes, but the backups stay with the host and may not cover a broader scenario (suspended account, dispute, error across the whole infrastructure). Check what is included, the retention and the restoration procedure.
How long should backups be kept?
A good compromise: daily for 14 to 30 days, monthly for 6 to 12 months for regulatory data. Retention should be adapted to your sector's obligations.
What is an immutable backup?
A copy that cannot be modified or deleted for a given period, even by a compromised account. It protects against ransomware that also encrypts accessible backups.
Can a site be restored without downtime?
By restoring on pre-production and then switching over, you minimise downtime. For a critical site, the restoration procedure should be tested at least twice a year.
Updated on
Related guides
Version française: /services/devops-securite/sauvegarde/ · AR · NL