A second copy, checked byte by byte

Everyone has backups. The uncomfortable question is what they would be worth on the day you need them — because between "we make copies" and "we can hand you your business back" there is an entire discipline. We wrote earlier about tested restores; this post is about the other half of that discipline: where the copies live, and who is checking them.

Two copies on the same shelf are one copy

Most backup stories fail at geography. The copy sits on the same disk, under the same account, with the same credentials as the thing it protects — so whatever destroys the original (a failed drive, a compromised account, one command typed in the wrong window) destroys the copy in the same stroke. Redundancy that shares a failure domain is arithmetic, not protection:

A copy next to the original is not a second copy.

The nightly rhythm

Every night, every instance packs its databases, files and configuration and ships them, encrypted, to its own off-site store — with retention that keeps seven daily, four weekly and twelve monthly copies. Then a second, independent machine — separate hardware, a different location, its own credentials — maintains a versioned mirror of the whole tree: not just the latest copy, but yesterday's version of every file, and last month's. One thing is deliberately missing: secrets. Credentials are never backed up; on a restore they are regenerated, so a copy can never leak a key.

Checked, byte by byte

A backup nobody reads is a rumour. On the 15th of every month we restore for real and compare the mirror byte for byte against the primary copies; on the 20th we rehearse full disaster recovery — a production instance rebuilt from nothing, end to end. And silence is treated as failure: every backup job carries a dead-man's switch, so the copy that quietly didn't run raises an alarm instead of a surprise. It is boring machinery, tended monthly — which is exactly what you want underneath your business on its worst day.