Area 07 · Operations and infrastructure

Backup and recovery

A backup dashboard glowing green proves surprisingly little. The real test comes the Monday after ransomware strikes: can your accounts team post in BMD from eight o’clock, and will the web shop accept orders again by midday? We begin with exactly that. For every system we settle the tolerable downtime and the number of working hours you could stand to lose, and only then choose software, storage targets and retention. The finale is an actual restore, clock running. We deliver the whole thing remotely, restore drills included.

Send an enquiry Our two services

3-2-1

data held three times, on two media types, once outside the building

Log

for each trial restore, stating date and duration

AT or EU

location of the external copy

Recovery plan

on paper well ahead of any emergency

Our two services

They work as a pair. The first fixes the what, the how often and the evidence that restoring is possible. The second guarantees a copy that stays out of reach of a burst pipe in the server room as well as of an intruder holding administrator rights.

Send an enquiry

Backup set-up

Meant for firms lacking a real concept, or owning one nobody has questioned for years: data sources catalogued, goals per system, jobs configured, alerts routed and restore drills put in the calendar.

Cloud backup

An encrypted external copy in an Austrian or EU data centre, protected by its own login and an object lock. An attacker who controls your Windows domain still cannot delete it.

Goals come before products

Two figures are agreed per system. RTO stands for the maximum tolerable outage; RPO for the slice of recent work that could vanish in a worst case. The guideline values below fit many companies of ten to fifty employees and serve as a basis for discussion.

Bookkeeping and merchandise system

RTO four hours, RPO sixty minutes. One overnight copy of BMD, RZL or Business Central falls short on the day the advance VAT return falls due. Transaction log backups throughout office hours are needed on top.

File server and SharePoint

RTO and RPO of one business day. A nightly job is normally sufficient, supplemented by intraday snapshots so an accidentally overwritten spreadsheet reappears in minutes.

Exchange Online mail

RTO four hours, RPO sixty minutes. Microsoft’s deleted-items retention has limits. A thread removed last spring or a departed colleague’s mailbox can usually only be recovered from a backup that lives outside the tenant.

E-commerce

RTO sixty minutes, RPO a few minutes. With orders streaming in via Shopware and amazon.de and buyers paying by eps, restoring from backup takes too long. The answer is database replication plus a warm spare environment.

Practice management software

RTO two hours, RPO sixty minutes. A surgery cannot see patients without charts and the day’s schedule. Health records additionally demand an encrypted copy and precisely defined access.

Notebooks

RTO and RPO of one business day. Only realistic when files are kept in OneDrive or SharePoint, with that storage backed up too, rather than on one person’s desktop.

Keep backups independent of your Windows domain. When the backup software authenticates against the very Active Directory everybody uses, one stolen administrator credential lets an intruder erase every restore point before launching the encryption. We therefore give the backup platform separate logins with MFA and make sure that at least one destination is locked against deletion, administrators included, until retention expires.

Four stages

We carry out each stage through protected remote sessions on servers, NAS devices and Microsoft 365. Stages one to three are routine craftsmanship. Stage four, the timed restore, is the one frequently skipped, and it alone delivers real proof.

Locate every data source

We look at where staff actually save their work. Almost always something escapes the backup: offers stored on a notebook’s desktop, a specialist program’s database parked on a secondary disk, construction drawings in a personal Dropbox.

Agree the numbers

With you, we assign each system an acceptable outage and an acceptable loss. These values shape what gets spent, never the reverse.

Build and watch

Schedules, retention periods, encryption and the external target. You are warned not only about failed runs but also about a status mail that should have come and did not.

Demonstrate recovery

On the agreed cycle we pull chosen data back into a sandbox and measure how long it took. The dated log can go to auditors, insurers or your managing director.

Frequently asked questions

It is, because a stored backup and a working recovery are two separate things. Audits reveal the same issues again and again: a job still pointed at a drive the ERP left long ago, an external disk full since spring, an encryption key known solely to a technician who has moved on. A short remote engagement tells you whether your current backups would rescue you and what should be altered.

Microsoft keeps the platform available and guards against hardware failure within its own facilities. It offers only partial help against purged folders, expired recycle bins, a hijacked user or malware that encrypts OneDrive content. A separate tenant backup with retention under your control fills that hole.

They are your final safety net, as long as the attack does not destroy them too. Modern criminal groups frequently spend days searching for backup servers and storage to wipe them ahead of the encryption. An object-locked copy with an external provider, together with a restore rehearsed not long ago, lets you resume business without paying anyone. You may also notify CERT.at, and once personal data is affected, the notification deadline towards the data protection authority applies.

A proven baseline: 30 days of daily points, three months of weekly and twelve months of monthly ones. Bookkeeping records fall under a seven-year retention duty in the Austrian Federal Fiscal Code (BAO), while medical records follow separate and generally longer rules. Your tax adviser or professional chamber confirms what applies; we translate that into backup policies. Equally, personal data should not be stored beyond what is necessary.

They do. Among the security measures the GDPR lists is being able to bring personal data back quickly after an incident, and NIS2 asks essential and important entities for business continuity management. A series of dated recovery logs is tangible evidence. Whether NIS2 and Austria’s NIS Act cover your organisation is a question for your lawyer.

Your NAS or server raises an alarm, which typically reaches us first. We name the right replacement model and send a photo with the defective slot circled. A member of your staff swaps it while we guide them over video, or your local IT partner does it. Rebuilding the array and verifying the data then happen remotely under our supervision. Apply neither travels to clients nor sells hardware.

Let us test whether your backups really come back

We inspect your present configuration remotely, run a genuine restore and give you a frank verdict on whether it would carry you through an incident.

Email
office@apply.at

Availability
Monday to Friday, 8:00-17:00 Austrian time (CET/CEST), reply within one working day

Meetings
By video on Microsoft Teams or Google Meet

By ticking this box I allow Apply to process my details for the purpose of answering this request (see our privacy notice for details)