- Most business owners assume their email host backs up their inbox forever.
- That assumption is often wrong — here is how to check, and what to do about it.
A common and costly assumption: "my email provider backs everything up, so I do not need to worry." In reality, most platforms retain deleted data for a limited window — often 30 days — after which it is genuinely gone. For a business that depends on years of correspondence, contracts and records, this is a real exposure.
What Can Go Wrong Without Backups
- An employee accidentally deletes an important folder, discovered months later.
- A compromised account is used to mass-delete mail before the breach is noticed.
- A billing lapse suspends an account and its data along with it.
- A platform migration loses data due to incomplete export tools.
What a Real Backup Strategy Looks Like
- Automated, regular exports of mailbox data to storage independent of your email provider.
- Retention beyond the platform default — years, not weeks, for finance and legal correspondence.
- Immutable or offline copies so ransomware or a compromised admin account cannot destroy the backup along with the original.
- Documented restore process that has actually been tested, not just assumed to work.
Options for Nepali Businesses
- Third-party backup services purpose-built for Google Workspace or Microsoft 365 (many offer daily automated backups).
- Periodic manual exports (.mbox or .pst) stored securely offsite for smaller teams on tighter budgets.
- Hosting providers offering backup as part of a managed email package — confirm retention period and restore process explicitly rather than assuming.
Questions to Ask Your Provider Today
- How long is deleted mail actually recoverable?
- Is there a cost or delay to restore a full mailbox?
- What happens to data if an invoice is paid late?
A Real Scenario Where the 30-Day Window Mattered
A common, costly pattern: a departing employee's mailbox is deleted during routine offboarding a few weeks after their last day, following standard practice with no specific backup taken first. Two months later, a client dispute requires referencing correspondence from that former employee's mailbox — correspondence that no longer exists anywhere, because the platform's own deleted-item retention window closed well before anyone realized it would be needed. A simple habit change closes this gap entirely: export a departing employee's full mailbox to secure storage as a standard, non-optional step of the offboarding checklist, before the account itself is ever touched.
Frequently Asked Questions
Is Google Workspace or Microsoft 365 backup enough on its own?
Their built-in retention is designed for accidental short-term recovery, not long-term business continuity — a separate backup layer is still recommended for critical data.
How often should backups be tested?
At least twice a year, restore a sample to confirm the process actually works — an untested backup is a false sense of security.
Should backup exports be encrypted?
Yes — an offsite backup containing potentially years of business correspondence is a meaningful target if it is ever accessed without authorization, so encrypting exported archives is a reasonable, low-cost precaution.
Ask us about backup options with your email hosting. See our business email plans or talk to our team.
Backup Frequency Matched to Business Activity
Not every mailbox needs the same backup frequency. A finance or sales mailbox generating new, business-critical correspondence daily justifies daily automated backups; a rarely used departmental mailbox may reasonably be backed up weekly or monthly instead. Matching backup frequency to how quickly each mailbox's data changes, rather than applying one blanket schedule to everything, is a practical way to control backup storage costs without meaningfully increasing real risk.
