This Schedule forms part of the IT Master Services Agreement and describes the scope, responsibilities and limitations relating to Backup and Recovery.

Backup and Recovery covers a set of optional services. You may not use all services described in this Schedule. The specific services in place for you will be confirmed in your Order.

These components are optional add-ons. Only the services listed in your Order and any Statement of Work are included in your Backup and Recovery service.

1. Service overview

Backup and Recovery services are designed to reduce the impact of data loss and system failures by providing:

  • regular backups of in-scope systems and data;
  • appropriate retention of restore points;
  • a defined process for requesting and performing restores; and
  • optional business continuity capabilities where infrastructure can be brought online elsewhere.

Backup and Recovery cannot guarantee that all data will always be recoverable, but it significantly improves the chances of restoring critical systems and information after an incident.

2. Service components

Backup and Recovery may include one or more of the following components (subject to your Order):

  • Microsoft 365 / Google Workspace Backup - Cloud-to-cloud backup of Microsoft 365 and/or Google Workspace data using a managed SaaS backup platform.
  • Cultrix Cloud Backup - server-level backups for Cultrix Cloud (Linux hosting platform);
  • Endpoint Backup and Business Continuity - backup and optional VM spin-up in the cloud for covered endpoints;
  • On-Premise BCDR Appliances – managed backup and disaster recovery appliances providing advanced back

Availability of, and entitlement to, each component is determined by the services you purchase.

3. Microsoft 365 / Google Workspace Backup (cloud-to-cloud backup for Microsoft 365 and/or Google Workspace)

Where you subscribe to Microsoft 365 Backup:

  • cloud-to-cloud backup for Microsoft 365 and/or Google Workspace takes regular backups (typically up to three times per day) of supported Microsoft 365 data including Exchange Online, OneDrive, SharePoint Online and, where supported, Teams;
  • backups are stored in the managed backup platform’s cloud storage with effectively unlimited retention for the duration of your subscription;
  • backups are independent of Microsoft’s native recycle bin and retention features.

Restores may include:

  • full mailbox or OneDrive restores;
  • granular item-level restores (for example individual emails, files or folders);
  • restore to original location or export where supported by the platform.

Indicative recovery point objectives (RPO) are aligned to the backup schedule (for example approximately 8 hours where three backups per day are taken). Recovery time objectives (RTO) depend on the nature and size of the restore and will be handled on a reasonable-efforts basis, prioritising business-critical restores.

Note: Where devices sync Desktop and Documents to OneDrive or Google Drive, these folders are included in Microsoft 365/Google Workspace Backup. This backup does not cover non-synced files stored locally on the device.

4. Cultrix Cloud Backup (Linux hosting platform)

Where you host websites or applications on Cultrix Cloud (our Linux hosting platform):

  • server-level backups are taken daily (typically around 01:00 UK time);
  • we retain at least seven daily backups, four weekly backups and twelve monthly backups;
  • backups capture server files, databases and configuration as part of the platform backup set.

At present, these backups are stored within the same datacentre infrastructure at Custodian DC (Maidstone). Off-site replication can be added where required and would be documented in your SoW.

For Cultrix Cloud:

  • RPO is typically up to 24 hours (based on the daily backup cycle);
  • RTO for platform-level recovery is usually between 4-8 hours for major incidents, subject to the nature of the failure and data volumes.

5. Endpoint Backup and Business Continuity

Where you subscribe to endpoint backup services, we provide:

  • Basic endpoint backup - backup of selected data from covered desktops and laptops, typically user data such as Documents and key profile folders;
  • Endpoint business continuity (where purchased) - the ability to recover an endpoint image as a virtual machine in the cloud where the original device has failed, enabling users to continue working from a temporary environment.

The specific tools, backup frequency, retention and which folders or volumes are included will be set out in your SoW or backup configuration documentation. Unless otherwise agreed:

  • RPO for endpoint backups is defined by the backup frequency (for example daily or more often where configured);
  • RTO for endpoint VM recovery depends on image size, available bandwidth and concurrency at the time of recovery.

Note: Endpoint Backup protects data stored locally on devices that is not synced to OneDrive or Google Drive, and may also provide device-level recovery options. It complements Microsoft 365/Google Workspace Backup.

Note: Endpoint-level backup and endpoint business continuity options (including cloud failover and on-premise backup and business continuity appliances) fall under Endpoint Protection and are described in Schedule 6. These services are optional add-ons and not included in core Backup and Recovery unless stated.

6. On-Premise BCDR Appliances

For customers with on-premise servers or virtual environments, we may deploy managed BCDR appliances to provide advanced backup, disaster recovery and business continuity capabilities.

Where you subscribe to these services:

  • server images and data are backed up to the appliance on a scheduled basis (for example hourly or daily, depending on your configuration);
  • backups are replicated from the appliance to the managed cloud recovery environment (where supported by the chosen solution and configuration);
  • in the event of a server failure, workloads can be spun up directly on the appliance or in the managed cloud recovery environment (subject to bandwidth and capacity), providing business continuity;
  • retention policies and backup schedules can be tuned to your needs within the capabilities of the chosen appliance and subscription.

RPO and RTO for on-premise BCDR are solution-specific and will be documented in your backup design or configuration document.

7. Restore requests, RPO and RTO

Unless otherwise stated, restore requests are raised via the Service Desk. You should clearly state:

  • what needs restoring (for example mailbox, site, database, VM, files/folders);
  • the approximate date/time of the desired restore point; and
  • the reason for the restore (for example accidental deletion, corruption, ransomware).

We will confirm feasibility and expected timescales based on:

  • the backup schedules and retention for the relevant service;
  • the size and complexity of the restore;
  • current workload and any higher-priority incidents in progress.

Where this Schedule or your SoW specifies RPO/RTO targets, these will be treated as reasonable objectives, not absolute guarantees, particularly in large-scale or multi-tenant incidents.

8. Customer responsibilities

To ensure Backup and Recovery remains effective, you must:

  • work with us to define which systems, data and folders are in scope for backup;
  • ensure covered systems and endpoints remain powered on and connected during backup windows where possible;
  • avoid storing critical business data solely on devices or locations that are not included in any backup service;
  • inform us promptly of major changes that could affect backup (for example new servers, migrations, or large data growth);
  • review backup reports and/or summary information where provided and raise any concerns quickly.

9. Service boundaries and exclusions

Backup and Recovery services do not include, unless explicitly agreed in writing:

  • guaranteed recovery of every item of data, particularly where data was never successfully backed up;
  • unlimited retention beyond the documented policies of the underlying platform;
  • legal hold/e-discovery design and management (although backups may assist such processes);
  • development or testing environments spun up from backups, except where part of a defined DR test or project;
  • coverage of systems or locations not onboarded into any backup component;
  • restoration of third-party systems where the vendor does not support restore from our backups.

Backup and Recovery is one layer in your business continuity planning. It does not replace the need for broader Business Continuity and Disaster Recovery planning, which is covered under separate documents and, where applicable, other Schedules.

10. Changes to this Schedule

Cultrix may update this Schedule to reflect changes in tooling, vendor capabilities, best practice or the range of backup and recovery services offered. We will publish updated versions on our website and, for material changes, provide reasonable notice.