Cloud Backup for Cloud Apps

If you think Google and Salesforce can keep your clients’ SaaS application data safe, think again. By Ellen Muraskin

You there, reselling cloud applications: Do you think that Google and Salesforce have a better handle on data protection than you do? If you answered “yes,” you would probably be right. Do you think that keeps your clients' SaaS application data safe from harm? If you again answered “yes,” you would be less right.

While Gmail has been known to go missing, the larger risk to your clients' cloud data is one of their employee's own human failings. When someone accidentally (or maliciously) deletes, corrupts, or overwrites a file and no one notices before the next backup, it doesn't help to have completely current and identical data in two places, because it's identically missing what's lost.

For this, you need multiple, point-in-time backups, and to be able to restore from the one made right before the glitch. That, in a nutshell, is the case for backup-as-a-service of SaaS application data. It's a case that Cambridge, Mass.-based Backupify makes to consumers and resellers, the latter getting a 20 percent discount off MSRP on subscriptions to the service.

According to Daniel Stevenson, Backupify's vice president of partnerships and alliances, the service now has more than 100 Google App resellers, some of whom offer the service as an add-on and others who bundle it with cloud apps. “For resellers, it's also a way to recoup some of the revenue lost as a result of customers moving their apps from the server to the cloud, and their traditional backup from the reseller,” notes Stevenson.

It's worth noting here that Google Apps, at least, does keep versioned copies of shared files, knowing that a shared file is one whose vulnerability is multiplied by the number of users with editing privileges. But without some external backup, the file owner's deletion wipes out all versions. (See also Google Apps Vault, a storage add-on announced in March that appears to be aimed more at regulatory archiving.)

MIGRATING ACCOUNTS
Another good case for backup-as-a-service of SaaS data is account migration. Crisantos Hajibrahim is cofounder of Los Angeles-based Google Apps reseller ViWo, where Backupify business in the education market is brisk, he says, for that purpose. Schools use the service to move their students' .edu email accounts back out to Gmail when they leave.

The future, Hajibrahim says, is having one vendor and one reseller or MSP backing up and restoring all and any of your cloud apps' data - your whole sky, if you will - under one interface. Backupify, with backing from security powerhouse Symantec, is working on this, having recently announced a separate backup service for Salesforce.com, and similar support for Facebook, Twitter, Gmail, Google Drive, Google Calendar, Google Sites, Google Contacts, Flickr, Picasa, LinkedIn, Blogger, and Zoho in one social media package.

Another name in this space is Spanning Cloud Apps Inc., in Austin, Texas, which similarly offers cloud backup for Google Apps email, docs and drive, calendars, and contacts.

At sign-up, users grant Backupify access to their application data. The service then accesses that data through an app's own API, encrypts it, and stores it every day to Amazon S3 hosted servers. Users log into a Web interface, and search and restore data back to their cloud or on-premises storage.

Look for cloud backup that lets you search granularly for individual files or emails; your clients don't want to spend time restoring or poring through multiple files. Make sure backups are performed per schedule and as-needed, typically just before software updates, and that permissions can be finely defined and enforced for each user, so that each can delete only the files for which he or she has responsibility. Consider security in the light of your industry's encryption requirements.

Rachel Dines, senior analyst at Forrester Research, adds a few recommendations: Check to see what happens upon service termination; is your data securely deleted? Check retention policy: How many versions are kept, how often made (usually every day), and for how long? She says 30 days is typical, with extensions at additional cost. And while the services usually charge per user per month or year, see if there are storage volume caps.

About the Author