The migration to SaaS applications has transformed how companies operate. Corporate emails, documents, collaborative spreadsheets, customer data, business opportunities, and team conversations now reside on platforms like Microsoft 365, Google Workspace, and Salesforce. The perception accompanying this transition was that, by contracting a large-scale cloud service, data protection was included in the package.

This perception is the main blind spot in SaaS security. According to Rewind's World Backup Day 2026 report , 43% of organizations believe that the SaaS provider takes care of backups or don't know where that responsibility lies. The contractual reality is different. Microsoft, Google, and Salesforce operate under a shared responsibility model, in which the provider guarantees the availability of the platform, but the client remains responsible for protecting the data stored on it.

In this article, you will understand what each platform does natively, what your company is responsible for, what the most common data loss scenarios are in SaaS, and how to structure a backup strategy that supports business continuity.

What does the shared responsibility model really cover?

The shared responsibility model is a conceptual contract between cloud provider and client that defines who is responsible for what. In SaaS environments, the division is quite clear. The provider is responsible for the physical infrastructure, application availability, security of the operating system hosting the service, and recovery in case of failures in its own infrastructure. The client is responsible for the data, identities, tenant configurations, access control, and protection against loss due to causes other than platform failures.

In practice, this division means that if Microsoft's data center experiences an outage and Exchange Online is unavailable for a few hours, Microsoft is responsible for restoring the service. However, if a collaborator permanently deletes a mailbox, if a ransomware attack encrypts files in synchronized OneDrive, if a third-party integrator deletes records in Salesforce due to a configuration error, or if a poorly executed migration overwrites documents in Google Drive, data recovery is the customer's responsibility.

And the contracts themselves make this explicit. The Microsoft Services Agreement formally recommends that customers use third-party solutions to regularly back up content and data stored on the service.

What each platform does natively

There is native protection on all three platforms, but it was designed to handle short-term, isolated errors, not real-world disaster recovery scenarios.

Microsoft 365

Microsoft 365 offers recycle bins in Exchange Online, SharePoint, and OneDrive, with default retention ranging from 14 to 30 days. There is also the option to configure retention policies with specific rules per data type. After this period, the deleted item is irreversibly removed by the platform.

Microsoft does not offer a point-in-time restore button for entire mailboxes deleted more than 30 days ago, and it does not protect against ransomware encryption on files synced via OneDrive, since the platform simply syncs what happens on the local device.

Google workspace

Google Workspace keeps deleted items in the trash for 30 days in Gmail and Drive. Administrators can recover items removed from the trash up to 25 days after deletion, extending the total window to approximately 55 days in favorable scenarios.

Furthermore, Google offers Vault as a legal retention and e-discovery tool, but Vault is not a backup tool. It is designed for compliance and search, not for agile restoration of large volumes or complex folder structures.

Salesforce

Salesforce is the most critical case of the three. The Salesforce recycle bin retains deleted records for only 15 days. The traditional Data Export Service, which generated weekly backups in compressed format, was discontinued as a free service, and the platform began offering Salesforce Backup as a separate paid service.

Without contracting this additional layer or a third-party solution, the company has a narrow window to identify and reverse losses, and no contractual guarantee of recovery after that period. According to Expert Insights' survey on SaaS backup , approximately 60% of companies using Salesforce operate without a dedicated backup solution.

The most common data loss scenarios in SaaS.

When talking to companies that have experienced data loss in SaaS environments, the most recurring scenario is not that of a sophisticated external intruder. It's that of everyday events that native protection doesn't cover.

Accidental deletion by user or administrator

A collaborator accidentally deletes an entire folder; an administrator adjusts permissions and moves data out of scope; an automated retention rule deletes content that should have been preserved. If the incident is only noticed weeks later, the native recycle bin has already been emptied.

Ransomware that spreads via synchronization

OneDrive, Google Drive, and other synchronization tools replicate everything that happens on the local device to the cloud. When ransomware encrypts files on the workstation, the encrypted version is synchronized and becomes the current version in the cloud.

Our article on the most common mistakes companies make when backing up data delves deeper into this type of structural flaw.

Terminated employee

When an employee leaves the company, their account is often deactivated and, depending on the settings and timeframe, the associated data is removed by the platform. Client emails, draft contracts, business contacts, and conversation history may disappear if an external copy is not preserved.

Poorly configured third-party integration

Applications connected via API can delete, overwrite, or corrupt records in bulk. This is particularly critical in Salesforce, where data migration tools, marketing integrations, and custom connectors operate with broad permissions.

Attack on privileged credentials

An attacker who gains access to an administrator account can intentionally delete data, remove retention policies, and empty trash bins before the incident is detected, thus negating the platform's native protection.

How much time do you have to recover? The hidden deadlines.

Discussions about backups in SaaS often come down to a direct question from decision-makers: if something goes wrong, how much time do I have to act before the information disappears? The answer varies by platform and data type, but in no case is the timeframe comfortable.

In Microsoft 365, an email deleted from the inbox and then from the Deleted Items folder enters the recoverable items retention for 14 days, extendable to up to 30 days in specific settings. A user completely deleted from Entra ID enters soft-delete for 30 days before permanent removal. In SharePoint and OneDrive, items in the recycle bin remain for a total of 93 days, considering both deletion stages. In Google Workspace, the default window is 30 days in the recycle bin, with the possibility of an additional 25 days for the administrator. In Salesforce, the timeframe is the shortest: 15 days in the recycle bin, without an automatic secondary stage.

These deadlines seem reasonable at first glance, but are often insufficient in practice. Many incidents are only identified when someone tries to access an old document, review an old contract, or consult a history of conversations from previous months. By then, the native window has already closed.

How to structure a backup strategy for SaaS

Adopting backup for SaaS doesn't mean duplicating what the platform already does, but rather covering what it doesn't. A consistent strategy considers five elements.

  1. Comprehensive coverage within each platform: In Microsoft 365, this includes Exchange Online, SharePoint, OneDrive, Teams (messages and channels), and Login ID. In Google Workspace, Gmail, Drive, Contacts, Calendar, and Sites. In Salesforce, standard and custom object data, configuration metadata, attachments, and relationships between records. Partial backups create a false sense of security.
  2. Retention aligned with the information lifecycle: Different types of data require different retention periods. Contracts and regulatory records may require retention for several years, while operational conversations may have shorter cycles. Backup retention should be defined by policy, not by the tool's default.
  3. Storage outside the vendor's ecosystem: If Microsoft 365 backups are stored in Azure and Google Workspace backups are stored in Google Cloud, a vendor outage affects both. Logical or geographical separation of storage is what underpins the principle of true resilience. Our article on this topic... The importance of offsite backup and disaster recovery in data centers. It explains why this separation is essential.
  4. Immutability against ransomware: Immutable copies, which cannot be altered or deleted within a defined period, protect the backup against intruders who have already gained privileged access. It is the natural evolution of the classic 3-2-1 backup rule.
  5. Regular restoration tests: A backup that has never been tested is an assumption, not protection. Tests should verify both data integrity and actual recovery times, comparing them to the objectives defined by the company. We recommend reading the article. How often should I back up my company's data?"to further the discussion on RPO, RTO, and protection cadence."

Frequently asked questions about backup for SaaS

Many questions arise when managers begin to assess the risk associated with their SaaS platforms. The questions below frequently come up in conversations with companies that have realized that native protection doesn't cover all scenarios and are evaluating how to structure an additional backup layer. The answers have been organized to support technical and executive decisions and can serve as an initial reference before an in-depth analysis of the environment and regulatory requirements of your operation.

If the data is in the cloud, isn't it already protected?

The cloud protects the availability of the infrastructure, not the content created within it. Microsoft, Google, and Salesforce guarantee that their platforms are up and running, with geographic redundancy and high availability. But they don't protect against user deletion, synchronized ransomware, integration errors, or malicious actions from within your account. That layer of protection is the customer's responsibility.

Isn't it enough to activate the trash bin and retention policies that the platform offers?

These tools are useful for reversing quick and specific errors, but they have short timeframes and structural limitations. Salesforce's recycle bin, for example, retains data for only 15 days. Scenarios involving late discoveries, attacks with administrator privileges, or mass deletion generally exceed the native window and leave no recovery alternative.

What is the difference between backup and legal retention?

Legal retention, such as Google Vault or Microsoft Purview, is designed for regulatory compliance and e-discovery. It preserves data to meet legal requirements and allows for detailed searching of large volumes, but it is not designed for agile restoration of large structures or for one-off operational recovery. Backup, on the other hand, is optimized for quickly recovering a folder, mailbox, or set of records, making it a complementary tool, not a replacement.

Does backing up for SaaS increase the risk of data leaks?

It depends on the chosen architecture. Enterprise backup solutions for SaaS operate with encryption in transit and at rest, strict access controls, and compliance with standards such as ISO 27001 and SOC 2. When implemented with clear access policies, segregation of duties, and continuous monitoring, these solutions reduce risk rather than amplify it because they ensure the company maintains control over its own data.

Do I need to back up Teams and SharePoint separately from email?

Yes. Each service within Microsoft 365 has its own data structure and retention policy. Messages from Teams channels, private chats, files stored in SharePoint, and videos in OneDrive need to be explicitly included in the backup scope. A well-structured solution covers all these services in an integrated way, not in isolation.

Protect your data in the cloud with a company that understands the Brazilian environment.

With 22 years of experience, Ayko implements backup, disaster recovery, and data protection strategies for companies operating in hybrid environments and relying on critical SaaS applications. Our work begins with a careful analysis of the environment, considering the platforms in use, regulatory requirements, and the real risk scenarios of the operation.

If your company wants to assess whether its data in Microsoft 365, Google Workspace, or Salesforce is truly protected, contact our experts and discover how to transform cloud backup into a consistent pillar of business continuity.