Backup as a Service (BaaS) providers handle offsite backup storage, scheduling, encryption, and restore for databases, VMs, and SaaS data. The team that picks one based on RPO (recovery point objective) and RTO (recovery time objective) targets, plus 3-2-1 backup compliance, avoids the surprise of an unrecoverable restore. The team that picks on price gets what they pay for - cheap BaaS that is slow to restore, charges per GB retrieved, or has spotty data centers.
Table of contents
- What BaaS actually delivers
- The 3-2-1 backup rule
- RPO and RTO - the metrics that matter
- Choosing a BaaS provider
- Common BaaS provider categories
- FAQ
What BaaS actually delivers
Offsite backup storage. The data is in a different physical location than the production system. The team that uses BaaS has geographic redundancy built in; the team that backs up to local disk only has data loss when the disk dies.
Scheduled and continuous backup. Most providers offer both - scheduled (nightly full, hourly incremental) and continuous (every change replicated). The team that uses continuous backup has RPO measured in seconds; the team that uses nightly has RPO measured in hours.
Encryption at rest and in transit. Data is encrypted before leaving the source, transmitted over TLS, and stored encrypted at the provider. The team that uses BaaS with encryption satisfies compliance requirements (HIPAA, PCI-DSS, SOC 2); the team that uses unencrypted backup violates most compliance frameworks.
Restore testing and verification. The best providers run automated restore tests - they restore a random sample of backups to verify they actually work. The team that has automated restore testing catches corrupt backups before they’re needed; the team that only tests on disaster finds out the backups are bad during the disaster.
The 3-2-1 backup rule
3 copies of data, on 2 different media types, with 1 offsite. The classic backup rule that prevents single-point-of-failure data loss. BaaS provides the ‘1 offsite’ automatically; the team still needs the 2 local copies (production + local backup) for fast restore.
Why 3 copies? One production + one local backup + one offsite backup. The team that has only production data has data loss on hardware failure. The team that has production + local backup has data loss on site disaster (fire, flood). The team that has all three has data loss only if two of three fail simultaneously.
Why 2 media types? A backup on the same disk type as production is vulnerable to the same failures. The team that backs up production disk to another disk has both copies vulnerable to disk controller failure. The team that backs up to tape or cloud has different failure modes.
RPO and RTO - the metrics that matter
RPO (Recovery Point Objective): how much data can the team afford to lose? Measured in time. RPO of 1 hour means the team can lose up to 1 hour of data; backups happen at least hourly. RPO of 5 minutes means continuous replication with 5-minute lag tolerance.
RTO (Recovery Time Objective): how long can the team be down? Measured in time. RTO of 4 hours means the team can be offline for up to 4 hours while restoring from backup. RTO of 15 minutes means near-instant failover to a hot standby.
The team that picks BaaS based on RPO/RTO knows what they need. A team with RPO of 1 day (tolerates losing a day of work) uses nightly backups. A team with RPO of 1 hour needs hourly backups. A team with RPO of 5 minutes needs continuous replication.
RPO/RTO drive cost. Higher RPO/RTO flexibility = lower cost. Hourly backups are cheap; continuous replication is expensive. The team that picks the cheapest BaaS without checking RPO/RTO gets violated SLAs during incidents.
Choosing a BaaS provider
Evaluate based on data type, volume, and restore frequency. The team that backs up 1TB of database nightly needs different BaaS than the team that backs up 100TB of object storage. The team that restores weekly needs different pricing than the team that restores hourly.
Watch for hidden costs: egress fees, per-restore fees, per-API-call fees. The team that picks a BaaS with $0.05/GB egress fee gets a $5000 bill on the first major restore. The team that picks all-in pricing has predictable costs.
Check the provider’s track record. Look for: data center locations (geographic redundancy), uptime SLA (99.9%+), security certifications (SOC 2, ISO 27001), and customer references in your industry. The team that picks based on track record avoids the next Backupify / Code Spaces disaster.
Test restore before committing. The team that restores a sample backup before signing a contract knows the restore works at the speed the SLA promises. The team that only reads the SLA discovers on disaster that ‘restore in 4 hours’ actually means ‘restore initiation in 4 hours, data transfer takes another 8’.
Common BaaS provider categories
Cloud-native: AWS Backup, Azure Backup, GCP Cloud Storage. Integrated with their respective clouds. The team that runs primarily on one cloud uses the native backup service for tight integration; the team multi-cloud uses a third-party provider for cross-cloud support.
Database-specific: Rubrik, Cohesity, Veeam, Commvault for enterprise databases and VMs. The team that runs enterprise databases (Oracle, SQL Server, SAP) uses these for database-aware backups (transaction-consistent, point-in-time recovery).
SaaS data protection: Spinbackup, Backupify, OwnBackup. Backup for Google Workspace, Microsoft 365, Salesforce. The team that runs SaaS applications uses these because SaaS providers do not back up customer data by default.
Open-source self-hosted: Bacula, Amanda, BorgBackup, Restic. The team that wants full control runs self-hosted backup software with offsite storage (S3, B2). Lower software cost, higher operational cost.
FAQ
What is the difference between BaaS and DRaaS?
BaaS (Backup as a Service) handles backup storage and restore. DRaaS (Disaster Recovery as a Service) handles full environment replication with automated failover. The team that uses BaaS has data backups; the team that uses DRaaS has a hot standby environment that can take over production within minutes.
How much does BaaS cost?
$0.005-0.02/GB/month for storage, plus per-restore or egress fees. The team that backs up 1TB monthly pays $5-20/month for storage but may pay hundreds per restore. The team that needs frequent restores pays more; the team that backs up rarely but restores occasionally picks flat-rate plans.
What is the best BaaS for small businesses?
AWS S3 + Veeam, Azure Blob + native backup, Backblaze B2 + CloudBerry - all viable. The team that runs on AWS uses AWS Backup for tight integration; the team that wants lowest cost uses Backblaze B2 ($0.005/GB/month) with a self-hosted backup agent.
Should I encrypt my backups?
Yes. Encrypt before transmission and store encrypted. The team that does not encrypt has data exposure risk if backups are intercepted or if the BaaS provider is breached. The team that encrypts satisfies compliance and protects against provider-side breaches.
How often should I test restores?
Monthly. The team that tests monthly catches backup corruption early; the team that tests only at audit time (annually) may have 11 months of unrecoverable backups. Automated restore testing (the provider restores a sample) is even better - daily verification with no manual effort.
What is immutable backup?
Backup that cannot be modified or deleted for a retention period. The team that uses immutable backups has protection against ransomware (attackers cannot delete backups). AWS S3 Object Lock, Azure Blob Immutable Storage, Backblaze B2 with Object Lock are examples.
How this fits the rest of the stack
For a sense of what the full project costs before it commits, the RunxBuild hosting calculator shows the line items together. The API, the database, the storage, the worker, the bandwidth - each one is a separate number, and the team’s mental model for the platform is the sum of those numbers.
Useful related references: