Saliem Talash: Back up your business email and files

Most small businesses run on two things they never back up: the shared inbox and the shared drive. Both live in the cloud, so it feels as if someone else is taking care of them. Up to a point, someone is. But "in the cloud" protects you against a broken laptop, not against a deleted folder, a departed employee's account or a locked-out administrator.

I'm Saliem Talash, I build practical tools for small businesses in Toronto and edit ZELR, and this is the backup plan I would set up for a small team on Google Workspace or Microsoft 365. It is about business accounts; a personal phone and laptop are a different job. Everything below comes from Google's, Microsoft's and the Government of Canada's own pages as they read on October 1, 2026. Menus and retention periods change, so check them against the pages listed at the end.

Start with the rule: 3-2-1

The Canadian Centre for Cyber Security's backup tips put it simply: adopt the 3-2-1 rule and keep 3 copies of your information (1 original and 2 backups), on 2 different media types, with 1 copy kept off site. The same guidance recommends having a backup stored offline, and says to test your backups to make sure they work.

For a business that works in Google Workspace or Microsoft 365, the original is the cloud account. The two backups are what this guide is about.

Why the trash is not a backup

Microsoft's shared responsibility page lists Microsoft 365 as a software-as-a-service example and says: "For all cloud deployment types, you own your data and identities." The same page says you are responsible for protecting the security of your data.

Both providers do give you an undo window. It is worth knowing exactly how long it is.

Google Workspace

Drive trash: files moved to the trash "are deleted forever after 30 days."
Gmail trash: messages stay in the trash for up to 30 days, then are permanently deleted.
Admin recovery for Drive: an administrator can recover deleted Drive items within 25 days after a user empties their trash. Google notes that a restore brings back everything removed in the chosen date range; you cannot restore individual files or folders.
Admin recovery for Gmail: after the 30-day trash period, admins have an additional 25 days to restore messages.
Deleted user accounts: an administrator can restore a deleted user up to 20 days after deleting it. Google's wording: "After 20 days, the data is gone and you can't restore it."

Microsoft 365

OneDrive recycle bin: for work or school accounts, you can restore files and folders deleted within the last 93 days, unless your administrator changed the retention setting.
Restore your OneDrive: Microsoft 365 subscribers can roll their whole OneDrive back to any point in the last 30 days. Microsoft presents its restore options for files that are deleted, overwritten, corrupted or infected by malware.
A departed user's OneDrive: by default, a person given access to a deleted user's OneDrive has 30 days to download the files they want to keep, according to Microsoft's SharePoint retention page. After that the OneDrive moves to the site collection recycle bin, where it is kept for 93 days.

Notice the pattern: weeks, not years. If nobody notices a missing folder for two months, these windows do not help.

Backup one: a full export you control

Both providers let you take your data out in standard formats. Do it on a schedule and store the result away from the account itself.

Google Workspace: Data Export (for the whole organization). Google's Data Export tool exports the same data users get from Google Takeout, plus admin-only data such as deleted data retained by Vault. Google lists these requirements and limits:

You need a super administrator account at least 30 days old, with 2-Step Verification turned on.
It is available in all Google Workspace editions. Organizations with more than 1,000 users should contact Google Workspace support first.
The export is available no earlier than 48 hours after you start it, typically takes 72 hours, and can take up to 14 days.
The exported data is automatically deleted 60 days from the start of the export, so download it promptly.

Google Takeout (for one person). Each user can export their own data with Google Takeout, if the administrator allows it. Google says an archive expires in about 7 days, and that you can schedule an export every 2 months for a year.

Microsoft 365: export a mailbox to a .pst file. In classic Outlook, Microsoft's steps are: File > Open & Export > Import/Export > Export to a file > Outlook Data File (.pst), choose the account, make sure Include subfolders is ticked, choose where to save, and finish. Microsoft notes that only one account can be exported at a time, and that the new Outlook for Windows uses a different route.

Microsoft 365: OneDrive and SharePoint files. Copy the important folders to a separate drive on a schedule, as part of the routine below, so that one copy of your files lives outside the account.

Backup two: off site, and ideally offline

The second backup is the one that survives a bad day: a ransomware attack, a compromised administrator account, a burst pipe in the office.

Options, from simplest:

An external drive that holds the exports and file copies, plugged in only for the backup and stored somewhere else, such as a locked drawer at home. That makes it both off site and offline.
A second cloud service from a different provider, under a different login.
A paid backup service. Microsoft's own option is Microsoft 365 Backup, which can back up SharePoint sites, OneDrive accounts and Exchange mailboxes, with recovery windows of 3 months, 6 months, 1 year or 2 years. Microsoft describes it as pay-as-you-go and lists $0.15 per GB per month, with free restores, on its overview page.

A routine a small team can keep

Monthly: run the full export (Google Data Export, or .pst exports plus file copies on Microsoft 365) and copy it to the external drive.
Monthly: take the drive off site again and unplug it.
Quarterly: test a restore. Open last month's export, find one specific email and one specific file, and confirm they open. The Cyber Centre's advice is to test your backups to make sure they work.
When someone leaves: export their mailbox and files before deleting the account. On Google Workspace, the restore window for a deleted user is 20 days.
Write it down: where the backups are, who runs them and when the last restore test worked. One page is enough.

The short version

Your cloud provider keeps the service up; you keep the data. Learn the undo windows, export everything on a schedule, keep one copy off site and offline, and test a restore before you need one.

I keep short, practical guides like this on my own site, and longer explainers on ZELR. For the exact steps and retention periods, Google's, Microsoft's and the Cyber Centre's pages below are the authority.

Sources

Drafted with AI assistance.