Cloud storage vs. local backup: why you need both, not either

The most expensive misconception in personal data is that Dropbox, Google Drive, iCloud Drive or OneDrive are "backups". They're sync — an excellent, different thing — and the gap between the two has a direction that matters: sync protects your files from your hardware, while backup protects your files from you (and from the software acting on your behalf). You need both, and this page is the honest anatomy of why.

What sync does, and does brilliantly

A sync folder mirrors a directory across your devices and the provider's servers. Drop a file in on the phone; it's on the laptop and the cloud. This is real protection against a stolen laptop, a dead drive, a coffee spill — the hardware failures. Version history on the big providers even keeps prior versions for 30 days, which rescues the accidentally-overwritten document. For working files, sync is the correct tool and nobody should live without it.

What sync cannot do — by design

Sync's defining property is obedience: it reproduces whatever happens in the folder, immediately, everywhere. That means: delete a file, and the deletion propagates — to your laptop, your phone, the cloud, and (with third-party sync wired through it) your "backup" drive in the cupboard. Ransomware encrypts your files, and the encrypted versions propagate — overwriting the good versions at industrial speed. A buggy app corrupts its own data folder — and sync faithfully distributes the corruption. There's no moment at which sync says "that looks like a mistake, I'll keep the old one." Backup software, by contrast, is built around history: snapshots at points in time, retained for months, restorable as of a date. The whole discipline exists to answer the question sync cannot: what did this folder look like last Tuesday?

The local half, and why the cloud alone isn't enough either

Backup in the cloud (true backup services, or your phone's device-backup) fixes the deletion problem. What it doesn't fix: the account itself — a forgotten password, a hijacked account, a terms-of-service change, a mistaken closure, or an automated ban can sever you from everything at once, and account recovery is a fragile thread when you most need it (build that thread properly). Cloud economics — every terabyte is a monthly bill forever, and re-downloading a whole life's data after an outage takes days. So the local offline copy — an external drive, updated on a schedule, unplugged when done — isn't nostalgia; it's the copy that depends on no company, no subscription, and no account state. It's also the copy CISA's ransomware guidance wants, because it's the one malware can't touch.

The honest minimum, assembled

Working files live in sync (pick a major provider; two-factor it — done right). Devices run real backups — phone device-backup and/or cloud backup software, not just the sync folder. And an external drive gets the periodic offline copy, drawer-stored (that's the 3-2-1 rule, quietly satisfied). Total setup time: one evening. Total monthly cost: a cloud plan you were probably already paying for. The alternative cost, once, is everything with no directions back.

Sources: CISA StopRansomware guidance (offline/immutable copies); provider version-history documentation (30-day windows vary — check yours). Reviewed September 2026.

Sources

• CISA — StopRansomware guidance