There’s a quiet assumption many of us make about our digital lives: that because our photos are in iCloud, our documents in Google Drive, and our files syncing to OneDrive, they’re safe.
They’re not. They’re convenient. Those are different things.
Cloud services are good at availability. They are good at synchronisation. They are usually very good at protecting against the failure of their own hardware. But they are not a complete strategy for preserving the things that matter to you.
The distinction matters more now than it used to.
I learned this the hard way
Years ago, I wrote about eighty pages of a novel on my home PC. Then the hard disk failed, and because I had no backup, the work was gone. I never rewrote it.
There is nothing unusual about that story, which is partly the point. It was not a sophisticated attack, a natural disaster, or a complex failure of infrastructure. It was just a disk failing, exactly as disks eventually do.
I had a more serious lesson earlier in my career. A software project — several months of work across a small team — ended up in a database that became corrupted. During recovery, I accidentally deleted the online backup. We moved to tape. The first tape failed. The second one worked. It was the only copy left.
Recovery happens under pressure, and pressure is when people make mistakes.
That experience stayed with me. Far too often in my life, I have found myself relying on the third copy: the last tape, the spare drive, the old export, the forgotten duplicate that suddenly became the only thing standing between inconvenience and permanent loss.
These days, I feel exposed without that third copy. Not anxious, exactly, but aware that without it I am trusting too much to luck.
Cloud sync is not backup
When you delete a photo on your phone, iCloud deletes it everywhere. When ransomware encrypts your desktop, it may encrypt the files in your synced OneDrive folder too. If your Google account is suspended because of a billing issue, an automated fraud trigger, or a false positive in a moderation system, your Google Photos library may become inaccessible while you try to resolve it.
None of this means cloud services are bad. They are extraordinarily useful. But synchronisation is not the same as recoverability.
Cloud storage is excellent at making your files available everywhere. That’s its job. But availability and durability are not the same thing, and the same account credentials that give you access can also give an attacker access, or give a platform the ability to revoke it.
What you actually control
There’s a useful way to think about this: if the only copy of something important lives inside someone else’s platform, your access to it depends on their systems, their policies, their authentication process, and your continued ability to prove that you are you.
That access can disappear in three ways. The platform can revoke it — a billing issue, an automated fraud trigger, a false positive in a moderation system. You can lose it through your own mistake — a forgotten password, a lapsed recovery method, an account you can no longer verify. Or someone can take it from you. AI-assisted attacks are faster and more targeted than they used to be. Phishing messages are personalised and grammatically correct. The goal increasingly isn’t just to read your email — it’s to own your digital identity and everything attached to it. More of our lives now sit behind a small number of accounts, which makes those accounts high-value targets.
All three routes lead to the same place: you’re locked out, and the files that matter most are on the other side of the door.
That’s fine for convenience. It’s not enough for preservation.
The files that matter most — family photos, scanned passports, property deeds, wills, insurance documents — are almost always the least protected. They’re not business-critical, so they don’t get enterprise backup treatment. They’re personal, so they feel safe in a personal cloud account. But personal cloud accounts aggregate so much of a person’s life in one place that they’re worth targeting precisely because of that.
This isn’t a reason to panic. It’s a reason to act.
The 3-2-1 rule
The standard in data protection is simple enough to remember: three copies of anything important, across two different types of media, with one copy held offsite.
In practice, for most people, that looks like: the original on your phone or computer, a copy on an external drive at home, and a copy somewhere physically separate — a relative’s house, a fireproof safe, a safety deposit box, or anywhere else that would survive the same event as your home.
The offsite copy is the one people skip. It’s also the one that saves you when the house floods, or the burglary takes both the laptop and the drive next to it, or ransomware reaches every device on your home network.
Encrypted USB drives and portable SSDs are cheap enough now that cost is rarely the real barrier. Once set up, the process is simple: connect the drive, run the sync, disconnect it, store it.
The important part is that the backup should not remain permanently connected to the same device or network. A drive that is always attached is convenient, but it is also reachable by the same malware, mistakes, and electrical problems as everything else.
What to back up
Photos are the obvious one — irreplaceable, high volume, almost universally under-protected. But documents deserve equal attention:
- Passport and driving licence scans
- Property deeds or tenancy agreements
- Wills and lasting power of attorney
- Insurance policies and certificates
- Birth certificates and marriage certificates
- A password manager export
The last item needs a specific caution. If you lose access to your password manager — account compromise, forgotten master password, platform closure — and you have no offline record, you lose access to everything it protects simultaneously.
If your password manager supports an encrypted export (1Password and Bitwarden both do), use that format and store the file separately from the device that created it. A plain-text export sitting in a downloads folder isn’t a backup strategy. It’s a new risk.
For most non-technical users, the simplest and most durable option is a printed copy of your most critical passwords — email, banking, password manager master password — stored with your important physical documents. It requires no software to read, survives account compromise, and a fireproof safe protects it as well as anything else in this list.
A note on work laptops
There’s another modern habit worth mentioning: using work devices as personal archives.
Many people keep personal contact lists, browser bookmarks, family documents, photos, or side projects on a work laptop because it’s the machine they use every day. That can become a problem very quickly. The growing trend in organisations is to disable access immediately when employment ends, including access to the laptop, corporate cloud storage, email, and sometimes anything synchronised through the corporate account.
That may be reasonable from the employer’s point of view. It can still be a shock if your personal information is trapped inside that environment.
If something matters personally, keep a personal copy under your own control.
Making it a habit
Backup that doesn’t happen regularly isn’t backup — it’s just an old copy. Once a month is realistic for most people. Tie it to something you already do on a fixed schedule: the first Sunday of the month, when you pay a recurring bill, whatever works.
The actual process, once set up, takes minutes. Connect the drive, run the sync, disconnect it, store it. Occasionally check that you can read the files and that you still have whatever password or recovery key is needed to unlock them.
A backup you have never restored from is partly an act of faith.
If you want to go a step further, use two drives and rotate them. Copy to the first drive this month, the second drive next month, and so on. At any point you have two physical copies at different points in time — which means a corrupted or failed backup doesn’t erase your only offline record. It also means one drive can always be offsite while the other is in use. Two cheap USB drives and a labelling system is all it takes.
The honest summary
The point is not to reject the cloud. Cloud services are one of the reasons ordinary people lose less data than they used to. A phone dropped in the sea no longer has to mean losing every photo on it. A laptop failure no longer has to mean losing every document. That’s real progress.
But convenience can create a false sense of permanence. The same systems that make your files instantly available everywhere also make it possible for mistakes, compromise, corruption, or account problems to propagate everywhere just as quickly.
A physical backup doesn’t prevent compromise. It means compromise isn’t catastrophic.
That’s the point. It’s a significant one.
Simon Griffiths 
Leave a comment