Data is lost to mistakes far more often than to attacks. One wrong delete statement, one AI-generated migration, one dropped table is enough. And it usually happens after the service starts going well.
What should you check?
- Automatic backups are actually on: free plans often ship with them disabled.
- The backup frequency and how long each copy is retained.
- Whether you have ever performed a restore: this matters most.
- Development and production are separate: wiping real data while testing is a common accident.
Why rehearse a restore?
Having a backup file and being able to bring the service back are different things. Attempting a restore surfaces missing permissions, format mismatches, and unfamiliar procedures. Discovering those on the day of the incident turns hours of recovery into days.
A backup you have never restored is not a backup. It is a guess.