A daily backup you actually own

Ask a vendor "do you back up my data?" and the answer is almost always yes. Ask "can I download a copy, today, that I can open and verify without you?" and the answers thin out fast. Those are different questions, and only the second one protects you when the vendor is the problem — an account lockout, a billing dispute, an outage, or a shutdown.

A backup you own has three properties: it's portable, it's verifiable, and it's restorable without the vendor. If any one is missing, you have something less than a backup.

A recycle bin is not a backup

Version history and recycle bins are useful, and they are not backups. They live inside the same system as your live data, run on the same account, and vanish with it. They protect you from your own mistakes — an accidental delete, a bad edit. They do not protect you from the platform: a suspended account, a region outage, a provider that exits the market. For that you need a copy that lives somewhere the platform doesn't control.

Property one: portable

Portable means a plain, open format you can open with ordinary tools — a zip of your files in their real folder structure, not a proprietary blob that only the vendor's software can read. The test: can you unzip it on a laptop with no special software and see your documents? If yes, it's portable. If you need the vendor's importer to make sense of it, it isn't — and that importer may not exist the day you need it most.

A good archive carries more than the files:

• the current version of every document, in its real folder path,
• older versions, if you keep version history,
• a manifest indexing everything, and
• the surrounding structure — folders, permissions, members, share metadata — so a restore rebuilds the shape, not just the bytes.

Property two: verifiable

An archive you can't check is a hope, not a backup. Verifiable means every file in the archive has a recorded checksum — a SHA-256 — so you can prove, offline, that each file is present and intact and that nothing was truncated or corrupted in transit.

The practical form of this is a command you can run against a downloaded archive that:

1. reads the manifest,
2. confirms every listed file is present,
3. recomputes each file's SHA-256 and compares it to the manifest, and
4. exits non-zero on any mismatch, so you can wire it into monitoring.

Run it on a schedule against a real download and you have evidence your backup works — not an assumption.

Property three: restorable without the vendor

The final test is the one people skip until it's too late: can you use the backup if the vendor is gone? Because the format is a plain zip with a readable manifest, the answer is yes — your documents are right there, in their folders, openable by hand. You are never holding a file you can only restore by asking the company that locked you out.

How Docplume does it

Docplume's optional backup add-on builds one archive of your whole organisation every day and emails every owner and admin a signed download link, valid for 24 hours. The archive is a plain zip: files under their folder paths, a manifest.json recording each document's id, size, SHA-256, mime, tags and metadata, plus your folders, permissions, members and share links. An offline backup:verify command checks the manifest and every checksum and exits non-zero on any problem.

Portable, verifiable, restorable without us. That's a backup you actually own.

A checklist

Before you trust any backup — ours or anyone's — confirm:

• You can download a full copy on demand, not just request one.
• The format is open and opens with ordinary tools.
• Every file has a checksum you can verify yourself.
• You've run a restore drill at least once, from the archive alone.
• The copy lives somewhere the platform can't revoke.

If all five are true, you can sleep. If not, you have a gap worth closing before you need it.