The 3-2-1 rule is the most durable piece of backup advice ever written. It is simple enough to remember and strong enough to survive most disasters. But applying it in a world where your data lives in Xero, Microsoft 365 and Google Workspace takes a little reinterpretation.
- Keep three copies of important data, on two different media, with one kept offsite.
- Your live SaaS data counts as just one copy — not a backup.
- A second copy in the same provider is not truly independent.
- An independent, offsite backup of SaaS data completes the rule for cloud-first businesses.
The rule, stated simply
The 3-2-1 rule says: keep three copies of your important data, store them on two different types of media, and keep one copy offsite. The logic is redundancy without correlated failure — no single event should be able to destroy every copy at once.
Why it still holds in the cloud
It is tempting to think the cloud retired this rule. The opposite is true. The principle — never let one failure take all your copies — applies perfectly to SaaS, you just have to count honestly. The most common mistake is treating your live cloud data as if it were already "backed up." It is not; it is your primary copy.
Counting your copies honestly
Picture a business running on Xero:
- Copy one — your live data inside Xero. Primary, not a backup.
- Copy two — an independent backup of that data, held by a different provider or on your own storage.
- Copy three — a further retained or offsite copy of that backup.
Note that a second copy inside the same provider does not satisfy the rule — if your account is compromised or your subscription lapses, both vanish together. Independence is the whole point.
The "two media, one offsite" part today
"Two different media" once meant disk and tape. Today it sensibly means two independent platforms or storage targets that do not share a failure mode — for example, your SaaS provider plus a separate backup service or your own cloud bucket. "One offsite" is largely automatic with cloud storage, provided it is genuinely separate from production.
Applying it to your accounts
For Xero, the practical 3-2-1 setup is: your live file, plus an independent daily backup written to storage you control, retained over time and isolated from your Xero login. That satisfies the rule and the Essential Eight backup strategy in one move.