The ongoing growth of the sheer volume of unstructured data being generated by applications makes the task of backing up this data increasingly challenging. It's become important for enterprises to control the number of storage siloes in their environments, and this is complicated by the take-up of cloud-based applications and the growing popularity of SaaS offerings. Unfortunately, data protection for SaaS applications is not a given, and customers have to be wary of what data-protection responsibility SaaS vendors offer for cloud-based application data.

The 451 Take

Protecting SaaS data is important for any enterprise – not doing so jeopardizes the potential value of the data from cloud-based applications. The reality is that, just because an application is being delivered as a service does not mean that accompanying data protection is being provided as well. Baked-in backup and recovery options can fall woefully short of guaranteeing any substantial resiliency for data, but this is still significantly better than not protecting the data at all. Fortunately, there are growing number of specialty and traditional data protection vendors offering products that protect SaaS and configuration data, and with cloud-to-cloud or cloud-to-on-prem backup offerings that should address SaaS data protection as part of a unified data protection strategy.

The need for cloud backup

The current state of the market, based on our recent Voice of the Enterprise: Storage, Budgets and Outlook 2017 survey, indicates that 49.2% of respondents are relying on their cloud vendor for backup and recovery, while 25.3% aren't backing up SaaS applications at all (see Figure 1). Considering how integral SaaS applications like those within Google's G Suite, Microsoft's Office 365 and Salesforce's platform have become to organizations, a failure to protect data being generated or kept within these applications is quite risky.

The companies providing these applications tend to offer basic levels of retention that varies from company to company, and can come with various limitations, such as only providing a window of 30 days to recover data before permanent deletion. For Google's G Suite, data permanently deleted from Gmail or Drive more than 25 days ago cannot be recovered. Microsoft offers some tools of its own, such as Windows Backup, which can be used for backup and recovery of cloud-based Exchange servers, as well as Microsoft's Support and Recovery Assistant for Office 365.

Protecting Salesforce data is a different challenge than more generalized document storage because its services are based on a proprietary application environment that can be heavily modified by its customers. This requires the protection of both configuration data and application data, and requires much closer cooperation and integration between Salesforce and a data protection vendor. Salesforce has a data recovery service that's offered as an option of last resort, and comes at a flat rate cost of $10,000 with a six- to eight-week timeframe for recovery. QuickBooks Online is another application that's gaining interest in the SaaS data protection market, and benefits from the protection of both configuration and application data.

Figure 1: Organizational strategy for SaaS data protection
Q. What is your organization's primary data protection strategy for SaaS applications?

Source: 451 Research, Voice of the Enterprise: Storage, Budgets and Outlook 2017

There are a number of threats that could easily result in data loss for these applications, including errors in data migration, accidental deletion of files, insider threats or applications unintentionally mismanaging data. Human error is the crux of many of these risks. Data recovery windows average about 30 days, so customers are faced with a relatively short time frame with which to detect and take action against accidental deletions or mismanagement of data.

Cloud-to-cloud backup is one method for protecting data from this kind of loss. However, only 10.8% of respondents are using a cloud-to-cloud backup application, although there are a number of vendors competing for the opportunity in this space. These products offer the ability to automate the backup of data from a SaaS provider to a given public cloud, like AWS S3 or Microsoft Azure, not only to protect it from loss, but also to centrally locate it for easier management and better visibility. This has the added bonus of potentially making it easier to comply with regulations such as HIPAA.

Vendors in the SaaS data-protection space


In the market, there are storage vendors offering cloud-to-cloud backup as part of their larger portfolios, as well as vendors that focus more exclusively on this use case. Typically, these offerings are catering to the most prominent SaaS applications, the previously mentioned Google G Suite, Microsoft Office 365 and Salesforce, although some also target Box, Dropbox, Evernote and other similar file sync/share services.

A number of vendors are active in the SaaS data protection space. Acronis offers backup protection for Office 365 mailboxes, individual emails, calendar tasks and contacts. Online backup pioneer Asigra has been doing SaaS backup for a few years now, and can protect Salesforce, G Suite and Office 365. Acquisition activity in this area has been light, but there have been some notable deals. Datto acquired SaaS data protection specialist Backupify in December 2014 for $50m, and we would note that Spanning Cloud Apps was initially acquired by EMC in October 2014, but ultimately sold the startup to Insight Venture Partners in April 2017 for an undisclosed amount.

There are a number of other players in the market, including Barracuda Networks, Carbonite, CloudAlly, Cloudfinder, CloudHQ, Druva, Metalogix Software, SkyKick, StorageCraft and Veeam. We will be doing more research in this area later this year.

Henry Baltazar
Research Vice President, Storage

Henry Baltazar is a Research Director for the Storage Channel at 451 Research. Henry returned to 451 Research after spending nearly three years at Forrester Research as a senior analyst serving Infrastructure & Operations Professionals and advising Forrester clients on datacenter infrastructure technologies.

Steven Hill
Senior Analyst, Storage

Steven Hill is a Senior Analyst of Storage technologies. He covers the latest generation of hyperconverged systems, cloud-based storage and business continuity/disaster recovery solutions for enterprise customers.

Liam Rogers
Senior Research Associate

As a Senior Research Associate in 451 Research’s Storage Channel, Liam Rogers covers technology and business-model innovation across the enterprise storage landscape – spanning primary storage systems and software, backup and recovery, archiving, cloud storage services, cloud-enabling storage technologies and storage management.

Want to read more? Request a trial now.