Your expert in backup and data protection!The solution tailored to your needs
What is the difference between backup and replication?
Replication maintains a copy close to the current state, so you can resume quickly after a failure. A backup keeps earlier states, so you can go back to before an error or an attack. The two complement each other: one does not replace the other.
Key points
- Replication is an availability tool: it also copies deletions, corruption and encryption.
- A backup is a rollback tool: it keeps several dates, at the cost of a slight delay (the RPO).
- The ANSSI, France’s national cybersecurity agency, points to replication when you cannot lose more than a few hours, and to backup to return to a healthy state.
- Microsoft 365 and Google Workspace recycle bins are short-term safety nets within the same tenant, not a backup.
Replication follows the original
A database replica, a virtual machine mirror or a file synchronisation sends changes to a second location, often within seconds. If the main server fails, you can switch to the second one and lose few transactions. It is an availability tool. The NIST contingency planning guide (SP 800-34) in fact reserves mirrored systems and disk replication for high-impact systems, combined with a standby site that is already running.
The replica also receives what should not be kept: a deleted file, a corrupted database, a document encrypted by ransomware. Depending on the mode (synchronous, asynchronous, with or without delay), the healthy copy disappears at the same time as the original, or a few minutes later.
A backup keeps the past
A 2 pm backup, a 6 pm backup and one from the previous evening remain available. If the attack started at 4 pm, you restore the 2 pm backup. You lose the afternoon’s work. You recover a usable system. This deliberate gap is the RPO.
A backup is generally less “fresh” than replication. It is the only one of the two that allows you to roll back. The ANSSI backup guide says so in its own way: it excludes from its scope requirements for data loss of less than 24 hours, for which it recommends synchronous or asynchronous replication.
Comparison
| Replication | Backup | |
|---|---|---|
| Purpose | Resume quickly after a failure | Return to an earlier healthy state |
| Freshness of the copy | Seconds to minutes | Hours (depending on frequency) |
| History | None or very short | Several days, weeks or months |
| Deletion, corruption, ransomware | Copied to the replica | Earlier versions intact |
| Outright hardware failure | Fast failover | Restore, which takes longer |
How to combine them
| Need | Suitable tool |
|---|---|
| Resume within minutes after a hardware failure | Replication or BCP, with a second system already in place |
| Return to before a deletion or an attack | Backup with history, ideally a copy the attacker cannot modify |
| Both | Replication for outright failures, immutable backup for errors and ransomware |
A company that does not replicate and backs up every night accepts redoing up to 24 hours of work, and waiting for the restore. A company that only replicates may restart quickly and discover that the replica is already encrypted.
The case of the cloud
A hosting provider’s geo-replication protects against a data centre fire. It copies the state of the volume, including a volume already encrypted by the attacker. It is not a backup history.
The Microsoft 365 and Google Workspace recycle bins are short-term safety nets, inside the same administrator account. In Exchange Online, a deleted item remains recoverable for 14 days by default, 30 days at most. In Gmail, an administrator has 25 additional days after the 30-day trash period; after that, neither the administrator nor Google can restore the message. These mechanisms are neither replication to a third party nor a backup outside the tenant. See Does Microsoft 365 really include a backup?.
At WeDoBack
WeDoBack backup keeps versions, at the frequency chosen by the client. The BCP is different: cloud instances run continuously and take over if a server goes down, without any change of IP address, which comes close to service continuity. Data replication or synchronisation between the BCP instance and the original server is not built in: it relies on a specific process, tailored to the need, which WeDoBack can set up on quotation. The DRP restarts servers on standby instances from a chosen backup version. In both cases, the backup history remains the way to return to a state before the incident.
Frequently asked questions
If I replicate my server to a second site, do I still need a backup?
Yes. The second site protects you from a hardware failure or a disaster at the first. It does not protect you from a deleted file, a corrupted database or ransomware: the replica receives these changes like any others. Only a backup history lets you go back to before the incident.
Is a OneDrive or Dropbox synchronisation a backup?
No. Synchronisation copies the current state in both directions: a file erased or encrypted on the computer is erased or encrypted in the cloud too. The service’s versions and recycle bin help with an isolated error, for a limited period, but they remain under the same accounts as production.
Does delayed replication protect against ransomware?
Only if the attack is detected before the delay runs out, often a few minutes or a few hours. Yet an intrusion usually remains undetected for several days. A replication delay does not replace several weeks of history.
Further reading
Sources
Documents consulted in October 2026.
- Backing up information systems – The fundamentals (ANSSI-BP-100, v1.1, 27 November 2025) — ANSSI (France’s national cybersecurity agency)
- SP 800-34 Rev. 1, Contingency Planning Guide for Federal Information Systems — NIST
- Recoverable Items folder in Exchange Online — Microsoft Learn
- Restore a user’s permanently deleted email — Google Workspace Admin Help
- BCP offer (Business Continuity Plan) — WeDoBack
Planning a backup, DRP or BCP project?
More than 20 years of experience protecting business data.
Request a quote+33 9 72 50 78 28Protect your data with WeDoBack
Encrypted offsite backup, immutable storage, DRP and BCP: tell us about your servers and we will recommend the right combination.