Business continuity, proved before you need it.
Almost every business has backups. Far fewer can say how long recovery takes, how much work is lost, or when it was last tested. We run continuity and disaster recovery as a managed service, with agreed recovery targets, immutable copies an attacker cannot reach, and rehearsed recovery that has already been shown to work.
- Protect
Local and immutable off-site recovery points.
- Recover
Systems running again in minutes, not days.
- Prove
Scheduled tests, with a dated record.
A backup is a copy. Continuity is the ability to keep operating.
Four ways a backup that reports success still fails the business.
Backups nobody has restored
Jobs report success for years, then fail the first time a real recovery is attempted.
Copies an attacker can reach
Backups sit on the same network and the same credentials as the systems they protect.
No agreed recovery target
Nobody has said how long the business can be down, so nothing is designed to a number.
Cloud assumed to be covered
Microsoft 365 and SaaS data is presumed backed up by the provider. It is not.
Designed to a number, then tested against it.
The cycle repeats. Each pass re-checks what changed in the estate, re-verifies the recovery points and re-proves the recovery time, so the position you report is the position you would actually be in.
Baseline
Map workloads, dependencies, data volumes and current protection gaps.
Target
Agree recovery time and recovery point objectives per workload.
Deploy
Install the appliance, seed local and off-site copies, protect cloud data.
Verify
Automated boot and screenshot checks confirm each recovery point works.
Rehearse
Scheduled restore and failover tests against the agreed runbook.
Report
Monthly protection, test and exception reporting to leadership.
What the service includes.
- Recovery targets (RTO/RPO)
- Local recovery appliance
- Immutable off-site copies
- Instant virtualisation
- Microsoft 365 & SaaS data
- Ransomware recovery
- Recovery testing
- Continuity runbooks
Continuity design and recovery targets
Workloads are ranked by business impact, then given a recovery time and recovery point objective the business has actually agreed to, rather than whatever the current tooling happens to deliver.
Two-tier protection
A local appliance holds recent recovery points for fast restores, while an immutable off-site copy protects against site loss, hardware failure and an attacker with domain credentials.
Instant recovery and failover
Protected servers can be run directly from the appliance, or in the cloud where the site is unavailable, so the business keeps operating while the original environment is rebuilt.
Cloud and SaaS data protection
Microsoft 365, Google Workspace and other SaaS platforms are protected with independent retention, so deletion, tenant compromise or a lapsed licence does not lose the record.
Testing and evidence
Recovery points are verified automatically and full recoveries are rehearsed on a schedule, with a dated test record you can show to an insurer, auditor or client.
Runbooks and incident support
A written continuity runbook names the sequence, the decision-maker and the contacts, and our operations centre runs the recovery with you when it is needed.
Protect the workload. Recover the business.
Continuity is not one setting applied everywhere. Each workload gets a recovery target that reflects what it costs the business to be without it, and the design follows from that rather than from what the current tooling happens to do.
The same applies to scenarios. Losing a file, losing a server, losing a site and being attacked are different problems, and each one has its own written path back.
How this pairs with cyber resilienceOpen any item for what falls in scope, the recovery targets we design to, how recovery actually happens and the evidence you receive.
Physical and virtual servers
Image-based protection of Windows and Linux servers, including hypervisors, so a whole system can be recovered rather than a folder of files.
- Operating system, applications, configuration and data, protected as a full image with application-consistent recovery points.
- Recovery points typically every fifteen to sixty minutes, with critical systems running again inside an hour.
- Boot the recovery point locally on the appliance, in the cloud, or restore to new hardware once it is available.
- Per-server protection status, verified boot screenshots, retention position and dated restore test records.
Line-of-business applications and databases
Application-aware protection for the systems that stop the business when they stop, including SQL and finance, practice or ERP platforms.
- Database engines, application servers and the dependencies they need to come back in a working state.
- Short recovery points for transactional systems, with recovery sequenced so dependencies come back in the right order.
- Full system recovery, or granular recovery of a database or mailbox-level item where that is all that is needed.
- Consistency checks, restore test output and a documented recovery sequence for each application.
Microsoft 365 and Google Workspace
Independent protection for mail, files, sites and collaboration data that cloud providers replicate but do not retain on your behalf.
- Mailboxes, OneDrive and Drive, SharePoint and Teams content, and shared drives, held in retention you control.
- Multiple recovery points per day, with retention set to your legal, regulatory and contractual obligations.
- Point-in-time restore of a mailbox, site, folder or single item, in place or exported.
- Coverage against licensed users, retention position and a record of every restore performed.
Cloud servers and hosted infrastructure
Protection for workloads already running in public cloud or a hosted environment, so cloud does not become an unprotected island.
- Cloud virtual machines, attached storage and the configuration needed to rebuild them elsewhere.
- Recovery points aligned to the on-premises estate, so one continuity plan covers both.
- Recovery within the cloud platform, or to an alternative environment where the platform or region is the problem.
- Inventory of protected cloud workloads, verification results and cross-environment recovery test records.
Endpoints and remote workers
Protection for laptops and desktops holding working data, especially where people work away from a managed network.
- User devices in scope, their local data and the resynchronisation path back to managed storage.
- Daily recovery points, with recovery measured in hours rather than a device rebuild from scratch.
- File-level restore, or full device image recovery to replacement hardware.
- Device coverage reporting, last successful recovery point and exceptions for devices out of contact.
Ransomware and malicious-deletion recovery
The scenario the whole capability exists for: recovering a clean environment when someone inside the network has the keys.
- Immutable recovery points, isolated recovery environments and the sequence used to return to production safely.
- Identification of the last clean recovery point within hours, with staged recovery agreed with your incident lead.
- Systems stood up in an isolated environment, validated as clean, then returned to production in an agreed order.
- Immutability configuration, retention lock status, ransomware detection alerts and post-incident recovery report.
Site loss and extended outage
Fire, flood, theft, prolonged power or connectivity loss, or a landlord problem that puts the building out of use.
- Cloud failover for protected systems, remote access for staff, and the order in which services are restored.
- Critical services available from cloud within the agreed window, with the full estate restored progressively.
- Failover to cloud, operate from there while the site is unavailable, then a planned failback.
- Documented runbook, failover test results and the record of decisions taken during the event.
Regulatory, contractual and insurance retention
Where continuity is not just an operational need but a written obligation you must be able to evidence.
- Retention periods, data residency, restore-proof requirements and the reporting your obligation specifies.
- Retention and recovery targets set from the obligation rather than from the tooling default.
- Documented restore capability for the period the obligation requires, including historical points.
- Retention policy, residency confirmation, dated restore tests and the continuity report an assessor asks for.
Scope is agreed up front, workload by workload, so nothing is assumed to be protected that is not.
Recovery that does not depend on the day being calm.
The service runs on an enterprise continuity platform we licence, deploy and operate on your behalf. You do not buy the appliance, the storage or the software, and you do not staff it. Protection is continuous, verified and monitored, and recovery is a procedure rather than an improvisation.
Verified recovery points
Each recovery point is booted and screenshot-verified automatically, so a backup is only reported as good once it has been proven to start.
Immutable off-site retention
Off-site copies are written so they cannot be altered or deleted inside the retention window, including by an administrator account an attacker has taken.
Instant virtualisation
A protected server can be run directly from the recovery appliance or in the cloud, turning a multi-day rebuild into a decision taken in minutes.
Ransomware detection in backup
Recovery points are monitored for the behaviour that indicates encryption, so a clean point is identified early rather than discovered late.
Granular and full recovery
The same protection set supports a single file, a mailbox item, a database or an entire environment, without a separate product for each.
Managed and monitored for you
Failures, missed schedules and capacity issues are alerted to our operations centre and resolved as part of the service, not left in a dashboard nobody opens.
Reported in business language, backed by proof.
Leadership should not have to read a job log to know whether the business is recoverable. Each cycle produces a plain report on what is protected, what was tested, what failed and what needs a decision.
- Business impact and workload inventory
- Recovery targets per workload (RTO and RPO)
- Continuity and recovery runbook
- Scheduled recovery test report
- Monthly protection and exception report
- Post-incident recovery record
- Protected workload coverage
- Recovery points verified
- Retention against obligation
- Recovery tests completed
- Time to recover, tested
- Open exceptions and remediation
A monthly subscription, with the hardware included.
Managed BCDR is proposed on a twelve month agreement, billed monthly in advance and sized by protected capacity and workloads. The appliance, the off-site storage and the platform are part of the service, not a capital purchase.
Onboarding
Workload discovery, recovery target design, appliance deployment, initial seeding and the first recovery test.
Managed service
Protection, verification, monitoring, scheduled recovery testing, restores and failover, runbook upkeep and reporting.
No hidden fees
Restores, failover, egress and retrieval are included. Capacity growth and hardware refresh are handled inside the agreement.
Built for businesses that cannot simply stop.
- Downtime has a measurable cost per hour, and nobody has designed to it.
- An insurer, client or regulator asks for evidence of tested recovery.
- Ransomware is the scenario that would end the conversation about IT budget.
Clear boundaries keep the position honest.
We protect and recover what is in the agreed scope. Systems outside that scope, data already lost before onboarding, and application-level rebuilds owned by a third-party vendor are handled separately. Legal, insurance and forensic services are scoped with your own advisers.
Infrastructure and security modernisation at an operating refinery.
A high-consequence industrial site moved from ageing infrastructure and unproven backups to resilient, monitored and recoverable operations.
Read the case studyManaged BCDR, answered.
Is this the same as cloud backup?
No. Cloud backup copies data. Managed BCDR is the whole recovery capability: a local appliance for fast restores, an immutable off-site copy, the ability to run systems while the original environment is broken, and a tested plan that says who does what.
How quickly can we be back up?
It depends on the workload and the recovery targets you agree. Critical servers are typically virtualised locally within minutes to an hour, with cloud failover used where the site itself is unavailable. Every target is written down, then proved by testing rather than assumed.
Do you test recovery, or just monitor backups?
We test. Backups are verified automatically at each recovery point, and full restores and failovers are rehearsed on a scheduled cycle. You receive the test record, including what failed and what was corrected.
What happens in a ransomware event?
Recovery points are immutable, so they cannot be encrypted or deleted by an attacker inside your network. We identify the last clean point, stand systems up in an isolated environment, and recover in a sequence agreed in advance with your team.
Does this cover Microsoft 365 and cloud workloads?
Yes. Microsoft 365 and Google Workspace data, cloud servers and SaaS platforms are protected alongside on-premises servers, virtual machines and endpoints. Cloud platforms replicate for availability, not for your retention or recovery obligations.
Do we have to buy the hardware?
No. The appliance, the off-site storage and the platform are included in the monthly service. There is no capital purchase, and refresh at the end of term is part of the arrangement.
Are restores charged separately?
No. File restores, full system recovery and failover are included in the monthly service, with no egress or retrieval fees. Rebuilding an environment that was never protected under the agreement is scoped separately.
How is it priced?
As a monthly subscription on a twelve month agreement, sized by protected capacity and workloads, with a one-off onboarding fee covering design, deployment and the first full recovery test.
Find out how long recovery
would actually take.
We baseline what is protected today, set recovery targets with you, then run and test the capability that meets them.