A small business backup plan is not a product you buy. It is a short written list of every kind of record the business depends on, where each one actually lives, and how you would get it back if the device holding it stopped working this afternoon. Most owners discover they have no plan at the worst possible moment, because the question they have been answering in their head is “am I backing things up?” when the question that matters is “could I get it back, today, without the laptop?” Those are different questions and only the second one has a useful answer.
The good news is that this is an afternoon of work, not a project. The bad news is that almost nobody does it until after the first time it hurts.
What actually stops when the laptop dies?
Far more than the laptop. Owners tend to picture lost files, which is the smallest part of it. What really goes is the ability to do the ordinary things that make up a week.
The records that are only on that machine
Every business has a few. The spreadsheet that works out the quotes, with the pricing logic built into it over years. The folder of photographs of finished jobs. The customer list that was exported once and never went anywhere else. The scanned receipts in a folder called Receipts 2026. None of these feel precarious while the machine is on the desk and working.
The things you assume are in the cloud and are not
This is the one that catches people. Plenty of software keeps a local copy and only syncs when it feels like it, or syncs one folder and not another, or stopped syncing in March when a password changed and said nothing. Email is usually genuinely safe. The attachments you dragged out of email onto the desktop are not. The rule of thumb: if you have never seen that file from a different device, assume it is on one device.
The ways in, which are worse than the files
Saved logins, the authenticator app, the browser that stays signed in to the accounts software, the card details on file with the suppliers. Losing a machine can lock you out of the services that hold the backups, which is the failure mode that turns a bad day into a bad fortnight. The NCSC’s guide for small organisations treats recovery access as part of security rather than an afterthought, and that is the right way round.
How long do you have to keep business records anyway?
Longer than most people keep a laptop. If you are a sole trader or a partner in a partnership, HMRC requires you to keep your business records for at least five years after the 31 January submission deadline for the relevant tax year. A machine bought today will very likely be gone before the records it holds are allowed to be.
It is also worth knowing what happens if they are destroyed, because the answer is not “never mind”. HMRC’s guidance says you must do your best to provide figures, and tell them when you file that you are using estimated or provisional ones. That is an explicit admission on your return that your numbers are a guess. It is survivable, and it is not where anyone wants to be.
How do you build a small business backup plan in an afternoon?
Three steps, in this order. The order matters more than the tools.
Step one: list what the business keeps, and where it really is
Not every file — the kinds of record. Most businesses have between six and ten: customers, quotes and prices, invoices, receipts and expenses, job photos, staff and payroll, the website, the booking diary. Write each one on a line, and beside it write the actual place it lives. Not “the cloud” — the name of the service, or the name of the machine. The lines that end in a device name are your plan’s whole subject. Working through the software you are paying for is a fast way to remember the ones you forgot.
Step two: give every line a second home somewhere else
Two copies, and not in the same building or the same account. For most small businesses this is unglamorous: a reputable cloud service for the live work, plus an external drive that gets plugged in once a month and then unplugged again. Unplugged matters — a drive that is always connected shares the fate of the machine it is connected to, including anything malicious that reaches it.
Step three: test the restore, not the backup
This is the step that gets skipped and the only one that proves anything. Once, pick one real thing — last month’s invoices, say — and get it back from the second copy onto a different device. Time yourself. People discover at this point that the backup held a format nothing can open, or that it needed a password only the dead laptop knew, or that it had quietly stopped running in the spring. Better to find that out on a Tuesday afternoon than on the day it counts.
Write the result down in four lines: what you restored, from where, how long it took, and what went wrong. That is the plan. It fits on one page, and anybody in the business should be able to follow it, which is the real test — a plan only the owner can execute is a plan that fails whenever the owner is the one who is unavailable. The same argument applies to where the business inbox lives.
What we learned putting backup into our own app
We build Receiply, an app that photographs receipts and sorts them. Its design makes this problem sharper rather than softer, deliberately: receipt photos never leave your phone, and only the extracted text is sent for interpretation. There is no bank login and no silent upload of your images to anybody. That is the point of it, and it has a consequence we had to face honestly — if the pictures are only on the phone, then the phone is the only copy until the owner makes another one.
So backup is one file: a single ZIP with the photographs inside it, that you can put wherever you keep things. And the restore makes one promise that took longer to agree than to build — restoring merges, it never deletes. Bringing an old backup into a phone that already has receipts on it adds what is missing and leaves alone what is there. We chose that because the realistic moment someone restores is a panicked one, on a new device, not sure what is already on it, and a restore that wipes first would turn a recoverable afternoon into a permanent loss. Receiply organises receipts; it does not file anything and does not decide what is deductible. Keeping the records retrievable is the part it can honestly own.
We are not above this either. The system that publishes our own marketing runs in one browser on one Mac. If that machine is off, nothing goes out. We know it, we have written it down, and the plan for it is one line long — which is still infinitely better than finding out.
FAQ
How often should a small business back up?
Match it to how much work you are willing to redo. If losing a week of invoices would be painful but survivable, weekly is fine. If a day of bookings would cost you real money, you want the live copy in a service that syncs continuously and the second copy weekly.
Is a cloud service on its own enough?
Usually not, for one reason: a synced folder copies your mistakes as faithfully as your work. Delete a folder or encrypt it by accident and the sync obediently does the same everywhere. A second copy that is not synced is what protects you from yourself.
What if my records are already lost?
Rebuild from the places that hold copies for their own reasons — bank and card statements, supplier invoices, your email sent folder, your accountant. Then tell HMRC you are using estimated or provisional figures when you file, which is what their guidance asks for. Start the list on the same day, because the second time is preventable.
Who should hold the recovery details?
At least two people, or one person and a sealed written copy somewhere physical. Recovery codes and the authenticator app living only on the device you are recovering from is the single most common way a backup plan fails.
Does any of this need custom software?
Usually not. Most of the value here is the list and the tested restore, and both are free. Custom work earns its place when the records a business depends on live in something it built or something unusual, and nobody has yet answered the question of how those get back.
Where this leads
If you do one thing after reading this, make it step three. Backups that have never been restored are a feeling, not a plan, and the gap between the two is only visible from the other side. We build workflow automation for businesses whose records and routines have grown past what one machine should be holding, and recovery is one of the first questions we ask rather than one of the last. If you can name a record your business could not replace this week, tell us what it is and we will tell you what it would take to make it safe.
Related reading: Why your business automation stopped working.