Who Is Responsible for Data Stored in Cloud Office Apps

Email, shared files, chat messages and calendars have mostly moved into cloud services such as Microsoft 365 and Google Workspace. Many businesses assume the provider keeps a backup of all of it, in the same way it keeps the service running. In most cases that assumption is wrong. Companies like Veeam sell separate backup products for these platforms for exactly this reason, because the provider and the customer each look after a different part of the job.

What Does the Provider Actually Cover?

The provider’s side of the arrangement usually includes the following.

• Keeping the service available and meeting its uptime commitments.
• Protecting physical data centres and hardware.
• Replicating data across systems so a hardware failure does not cause loss.
• Securing the platform itself against attacks on its infrastructure.

The customer’s side usually includes these.

• Controlling who has access and what permissions they hold.
• Protecting against deletion, whether accidental or deliberate.
• Recovering from ransomware that encrypts files stored in the service.
• Meeting legal and industry rules on how long data must be kept.
• Keeping copies of data after an employee leaves and their licence is removed.

The two lists rarely overlap. A service can run perfectly while the customer’s data inside it is lost.

What Should a SaaS Backup Include?

A proper backup for cloud office apps keeps independent copies outside the provider’s normal deletion process. Tools such as Veeam Data Cloud cover Microsoft 365, Entra ID, Azure and Salesforce, though several other vendors offer similar services.

Whatever product is chosen, a few features are worth checking.

• Coverage of email, file storage, team sites and chat.
• Protection for identity and access settings, not only content.
• Retention periods that match the company’s legal and business needs.
• The ability to restore single items as well as entire mailboxes or sites.
• Storage kept separate from the main cloud account, ideally immutable.
• Clear reporting on what was backed up and when.

Restores should be tested like any other backup. Bringing back a full mailbox or team site once in a while confirms the process works and shows how long it takes.

Who Should Own This Inside the Business?

Responsibility often falls between teams. IT may manage the cloud tenant, while legal or compliance teams set retention needs, and nobody owns backup directly. Naming one person or team as responsible for SaaS data protection closes that gap.

That owner should know what is protected, where the copies are stored, how long they are kept and how to restore them. Cloud office apps handle much of a company’s daily work, and the provider keeping the service online does not mean the company’s files and messages inside it can be brought back when needed.