Cloud Backup for Freelancers: The 3-2-1 Rule and a Setup That Survives a Dead Laptop

A freelancer's laptop holds the whole business: client files, contracts, invoices, source files, passwords, drafts. When the drive fails, work stops, deadlines slip and clients start asking questions. The good news is that protecting against it is cheap. The bad news is that most people only learn how after the loss.

Key takeaways

• The 3-2-1 rule: keep 3 copies of important data, on 2 different types of media, with 1 copy offsite. This is the guidance published by the US Cybersecurity and Infrastructure Security Agency (CISA).
• File sync is not backup. If a file is deleted, corrupted or encrypted by ransomware, sync services can copy the damage everywhere.
• A backup you have never restored is a hope, not a backup. Test a restore every few months.
• Encrypt backups, use version history, and protect the backup account itself with multi-factor authentication.

What the 3-2-1 rule means

CISA's guidance for small businesses recommends exactly this, and adds that backups should run automatically and regularly, be encrypted, and be tested so you can restore quickly and roll data back at least seven days if needed.

The problem

One copy on one machine means one failure away from disaster. Drives fail. Laptops get stolen, dropped, soaked or infected. A single spilled coffee can end a project. The loss is not just files: it is the time to recreate them, the client trust, and sometimes a contractual obligation to protect their data.

Why it is harder than it sounds

Backups are widely recommended, yet it is easy to set one up and never check it. The obstacles are habits, not technology:

• It is invisible until it fails, so it never feels urgent.
• Sync feels like backup. A folder that mirrors to the cloud looks safe.
• Restores often go untested, so failures can be discovered at the worst moment.
• Ransomware targets backups. If the backup drive is always connected or the cloud account is weakly protected, it can be encrypted or deleted too.
• Client files carry obligations. Confidential work needs encryption and careful access control.

The gap: sync is not backup

The gap in most advice is confusing two different jobs.

Approach	Protects against	Does not protect against	Effort
Sync folder (mirrors files to the cloud)	Losing one device; access from anywhere	Accidental deletion and ransomware, unless version history is on and long enough	Very low
External drive, automatic	Drive failure, accidental deletion	Fire, theft or flood if it sits next to the laptop; ransomware if always connected	Low
Dedicated cloud backup service	Device loss, disaster, often ransomware if versioned	A weak account password; slow restores of very large data	Low
Git remote (for code and text projects)	Losing the machine; keeps history	Large binary files; anything you do not commit	Low
Network storage device at home	Convenient local restores	Fire and theft at home, unless replicated offsite	Medium

No single row is enough. The 3-2-1 rule works because it combines several of them.

The plot: why more copies changes everything

Here is a simple model. Suppose that in any given year, one copy of your data has a 5% chance of being lost, for any reason. Now suppose the copies fail independently, meaning one event does not take out the others. The chance of losing every copy multiplies down very quickly.

1 copy

5%

2 copies

0.25%

3 copies

0.0125%

Log scale: each step to the right is a large multiple, not an equal increment.

Illustrative model, not a measurement. It assumes each copy independently has a 5% yearly chance of loss. In real life, copies stored in the same place fail together, which is exactly why the rule calls for different media and an offsite copy.

Going from one copy to three cuts the chance of total loss from 1 in 20 to about 1 in 8,000. But the result depends entirely on the word independently. Two copies on the same desk are barely better than one. The "2 media" and "1 offsite" parts of the rule are what make the copies truly independent.

A strategy for a solo freelancer

Map the rule to a small, realistic stack:

1. Copy 1: your working files on the laptop.
2. Copy 2: an automatic local backup to an external drive, using the built-in Windows or macOS backup tool.
3. Copy 3: an encrypted, versioned cloud backup kept offsite.
4. Bonus for code and text projects: push to a private Git remote so history is safe too.

Step-by-step solution

1. List what would hurt to lose. Client deliverables, contracts and invoices, accounting records, source files, and the recovery codes for your accounts.
2. Choose your three copies using the stack above. Pick tools you will not have to think about.
3. Turn on automation. Backups should run without you remembering.
4. Encrypt everything. Use full-disk encryption on the laptop and drive, and an encrypted cloud backup, with the key stored somewhere safe that is not on the same laptop.
5. Turn on version history for at least 30 days, so you can recover from an infection or a bad edit noticed late.
6. Secure the backup account with a strong unique password and multi-factor authentication.
7. Disconnect or protect the local drive. Keep it connected only while backing up if you can, or use a service that keeps immutable versions.
8. Test a restore now, then every three months. Restore one folder to a new location and open the files.
9. Write down the restore steps so you can follow them under stress.

A quarterly checklist

• Do backups show a recent successful run?
• Have I restored a real file this quarter?
• Is the offsite copy still encrypted and versioned?
• Are the backup account's password and multi-factor method current?
• Did any new project folder fall outside the backup?

Common mistakes

• Treating a synced folder as a backup
• Keeping the "backup" drive in the same bag as the laptop
• Not testing a restore
• Forgetting to back up recovery codes and password-manager data
• Using one weak password for the backup account
• Storing client data unencrypted

Frequently asked questions

Is a synced cloud folder a backup?

File-sync services mirror a folder across devices, and some keep version history for a limited time. That can help, but if a deletion or a ransomware-encrypted file syncs across, the damage can travel with it. Treat sync as one layer, not the whole plan.

How much storage do I need?

Add up your working folders and multiply by roughly two to allow for versions. Most freelancers who do not handle video need far less than they expect.

Do I need an external drive if I have a cloud backup?

The 3-2-1 rule calls for two kinds of media, and a local drive restores large amounts of data much faster than a download. It is cheap insurance.

How often should backups run?

Automatically and continuously or at least daily for active work. CISA recommends regular, automatic backups and tested restores.

Does a Git remote count as a backup?

For code and text projects, yes, it is an excellent offsite copy with history. It does not cover large binary files or anything you have not committed.

Sources and further reading

1. CISA: Back up business data — 3-2-1 rule, automation, encryption and testing
2. CISA: Data backup options

Educational content, not professional security advice. Choose tools that fit your clients' confidentiality requirements.