Four ways files disappear from cloud storage
The first is human error. Someone tidies their OneDrive, deletes a shared folder they thought was theirs, and the folder vanishes for everyone. The second is overwriting: a staff member saves a template over a finished document, and nobody notices for months. Both happen weekly in ordinary offices. Neither looks like a disaster at the time, which is why they often go unnoticed until the original is needed for a client dispute, an audit or a tender that reuses old material.
The third is ransomware or a compromised account. Malware on a laptop encrypts synced files and the scrambled versions upload. Or an attacker who has phished a password deletes files deliberately before demanding payment. The fourth is account removal: when a departing employee's licence is removed, their OneDrive enters a deletion countdown, and after it ends their files are gone unless someone moved or backed them up first.
What the recycle bin and version history actually cover
Cloud services do give you some protection. Deleted files sit in a recycle bin for a limited period, and each file keeps a number of previous versions. Microsoft also offers a whole-OneDrive restore to a point in recent weeks. These features are genuinely useful and often solve small accidents. If your team already knows how to use them, keep encouraging it, because they are the quickest fix for a file deleted this morning or a version saved over yesterday.
They fall short in three ways. The time windows are limited, so a problem found after a few months may be past the point of rescue. The settings and history live inside the same account that has been compromised. And restoring in bulk is clumsy, especially when ransomware has touched thousands of files across many users at slightly different times.
The shared-responsibility point Microsoft makes itself
Microsoft, Google and Dropbox all describe their service on a shared-responsibility basis. They keep the platform running and protect against their own hardware failing. Protecting your data from your own users, attackers using your credentials, and your own retention needs is your job. That is why their own documentation recommends third-party backup for many businesses.
Put simply, the provider will not lose your files because a disk failed in their data centre. They also will not bring back a folder your bookkeeper deleted eight months ago, because from their point of view that was a legitimate instruction from an authorised user. The same applies to a former staff member who still has access and decides to remove things on the way out.
What to add on top
The fix is an independent backup service that connects to your Microsoft 365, Google Workspace or Dropbox account through an approved connection and copies everything to separate storage every day. It should keep versions for as long as you choose, allow restores of single files or whole accounts, and use credentials that are not the same as your everyday admin login. Look for a service that alerts someone when a backup run fails or a user drops out of protection, so silence genuinely means everything worked.
Pair that with sensible settings in the sync service itself: extend the deleted-file retention where you can, limit who can delete at the top of shared libraries, and have a clear offboarding step so departing staff files are moved before licences are removed. Set up alerts for mass deletion where your plan allows it, so a sudden burst of removed files triggers a notification rather than being discovered weeks later.
A quick test you can run yourself
Pick a file that was deleted three months ago, or a version of a document from last year, and try to get it back using only what you currently have. If you cannot do it in a few minutes, you have found the gap. Repeat the exercise for a whole user, imagining their account had been wiped. That second scenario is the one that hurts businesses most. It is also the scenario most likely to arrive without warning, through a phished password or a rushed offboarding on a Friday afternoon.
If either test fails, it is worth fixing before it matters. Adding a cloud-to-cloud backup is usually a quick, low-disruption change that staff never notice in their daily work. Once it is in place, repeat the two tests to confirm the new backup can do what the sync service could not, and write down the steps so anyone covering for you can follow them.
In short
- Sync spreads deletions, overwrites and encrypted files to every device.
- Recycle bins and version history have time limits and share the same login.
- Cloud providers protect their platform, not your data from your own users.
- Add an independent daily backup with its own credentials.