“Our files are in the cloud, so they’re backed up.” It’s one of the most common sentences in small-business IT, it feels obviously true, and it confuses two products that happen to share an adjective. Cloud storage (OneDrive, Dropbox, Google Drive) keeps your files available everywhere. Cloud backup keeps your files recoverable from anything. They look similar on a calm day; the difference is the whole story on a bad one. Here’s the distinction, sharply.

Sync’s defining feature is the problem

Cloud storage works by synchronization: change a file on your laptop, and the change propagates — to the cloud, to your other devices, to colleagues. That’s the product. Now follow the logic one step further: sync cannot tell a good change from a bad one. Delete a folder — the deletion syncs. Overwrite the right file with the wrong contents — synced. Ransomware encrypts your laptop’s files — OneDrive dutifully, promptly, efficiently syncs the encrypted versions everywhere, replacing the good copies on its way. Sync isn’t failing in these moments; it’s succeeding. It was built to replicate your current state, and it replicates disasters with exactly the fidelity it replicates everything else.

Storage products know this, which is why they include partial safety nets — recycle bins, version history, rolling restore windows. Genuinely useful for everyday oops-moments, and worth knowing how to use. But they’re retention features inside the same system, with three structural limits: short windows (measured in days-to-weeks, while real-world discovery runs longer), painful scale (rolling one file back is a click; rolling 40,000 files across 30 users back to Thursday is exactly what version-history UIs weren’t built for), and shared fate — the safety net lives inside the account it protects, so the compromised admin credential, the malicious insider, or the closed account takes the net down with the data. A safety feature an attacker can reach isn’t a backup; it’s a delay.

What backup adds: independence and history

A real backup is defined by what sync lacks:

  • Point-in-time history, kept on your terms — restore to before the problem: yesterday, last Tuesday, the week before the intrusion began, with retention you chose rather than a product default
  • A separate system with separate credentials — copies living outside the account that could be compromised, ideally with immutability, so destroying the original and destroying the recovery requires two different, unlikely victories
  • Restore-at-scale as the core feature — whole folders, whole accounts, whole points in time, inside recovery windows you’ve defined and tested
  • Coverage as policy — everything on the protection list gets captured on schedule, monitored, whether or not anyone remembered to put files in the right folder

That last point hides a subtle trap worth naming: some vendors market “backup” features that merely sync more folders into the same storage account — your Desktop and Documents “backed up to OneDrive.” Useful availability, same shared fate. The test is always independence: if this account were fully compromised or deleted, does the copy survive? If no, it’s storage.

Not a contest — a division of labor

None of this makes cloud storage bad; it makes it storage, and excellent at its actual job. The healthy architecture uses both, each doing what it’s for: storage as the everyday working layer — files available everywhere, shared cleanly, versioned for small mistakes — and backup as the independent recovery layer behind it: the storage platforms themselves backed up by a dedicated tool (a few dollars per user per month), servers and endpoints covered per the strategy map, all of it feeding the 3-2-1-1-0 design. Storage answers “can I get to my files?” Backup answers “can I get them back?” A business needs a yes to both, from two different systems — that’s not redundancy, it’s the definition.

The bottom line

Cloud storage replicates your present; cloud backup preserves your past — and recovery is always a question about the past. If your data protection story is “it’s in OneDrive,” you have availability with a thin safety net that shares its fate with the thing it protects. Add the independent layer, and the sentence becomes true the way everyone always assumed it was.