Backup and recovery in London —
immutable, regulator-grade, tested.
Servnet designs and runs backup and recovery for London businesses where data loss isn't a recoverable event — FCA-authorised firms under Operational Resilience, SRA-regulated law firms under client-money obligations, NHS London ICB-affiliated estates under DSP Toolkit, and mid-market firms targeted by ransomware. Veeam, Commvault, Rubrik or Veritas — sized for the workload, hardened against ransomware, restore-tested every quarter.
Why London backup needs to clear a higher bar
London concentrates the firms that ransomware actors target most aggressively (legal practices, financial services, healthcare) and the regulatory regimes that punish data loss most directly. Backup design for London customers starts from "assume the production estate is compromised" and works backwards from there.
FCA Operational Resilience PS21/3 backup requirements
For FCA-authorised firms in EC2/EC3 / Canary Wharf, backup is a control under Important Business Service resilience — it has to demonstrate recoverability within the firm's declared Impact Tolerance and survive both ransomware and supplier compromise scenarios.
SRA Standards 6.3 / 6.5 client-confidentiality + record-keeping
For WC2 / EC4 law firms, backup feeds directly into the SRA's client-money + client-confidentiality + record-retention requirements. Retention has to be defensible; deletion has to be auditable.
NHS DSP Toolkit Big Question 9.4 — backup and recovery
For London ICB-affiliated organisations, DSP Toolkit assertion 9.4 requires demonstrable backup and recovery aligned to data-sensitivity classification — our work lands directly against the assertion evidence.
Ransomware-actor targeting of London law + finance
London law firms and mid-market financial services are among the most-targeted UK ransomware victim categories. Backup design has to assume the production estate is compromised — immutable copies, air-gapped vaults, network-isolated recovery paths.
What Servnet backup delivers in London
Veeam Data Platform deployments
Veeam Backup & Replication, Veeam ONE, Veeam Recovery Orchestrator, Veeam for M365, Veeam Hardened Repository — full deployment, sized against the customer's data set and target RPO / RTO.
Rubrik Security Cloud + r7000
For City and Canary Wharf customers requiring zero-trust, immutable-by-default backup and integrated ransomware investigation — Rubrik Security Cloud + Cloud Vault, r7000 appliance, with the Anomaly Detection and Threat Hunting modules.
Commvault Cloud + HyperScale X
For larger London enterprise customers — Commvault Cloud, HyperScale X appliances, Metallic for SaaS / M365 / Endpoint, plus the Cyber Resilience layer for ransomware-isolated recovery.
M365 / Google Workspace SaaS backup
Independent backup of Microsoft 365 / Google Workspace tenants (Veeam for M365, Druva, AvePoint, Spanning) — because Microsoft + Google don't back you up; they retain.
Air-gapped vault + immutable storage
Off-fabric, network-isolated backup vault — typically a second City DC or a different region — that an attacker who owns the production network cannot reach. Combined with object-lock / immutability on the primary repository.
Quarterly restore exercises
For regulated customers we run quarterly tested restores — pick a workload, restore to isolated infrastructure, validate integrity, time-box the operation, document the result. Closes the loop for FCA / SRA / DSPT audit.
London backup + recovery customers
- ▸FCA-authorised firmsEC2/EC3 banks, brokers, asset managers — Veeam or Rubrik against vSphere / Nutanix / cloud estates, immutable repositories, Operational Resilience-aligned restore validation.
- ▸SRA-regulated law firmsWC2, EC4 magic-circle + mid-market firms — practice-management database backup, client-file retention, M365 mailbox + SharePoint protection, regulator-aligned restore validation.
- ▸NHS London trusts + ICBsLondon NHS trusts — clinical-system backup, DSP-Toolkit-aligned retention, HSCN-attached backup paths, isolated recovery infrastructure for ransomware scenarios.
- ▸Westminster public sectorSW1 departments and ALBs — backup of Crown Hosting / Azure Government workloads, NCSC-aligned retention, SC-cleared engineer attendance for sensitive restores.
- ▸Tech City fintechShoreditch / EC2A scale-ups — AWS / Azure backup, M365 protection, SOC 2-aligned retention, restore-runbook readiness for FCA-authorisation submission.
- ▸Multi-site retailersLondon-headquartered retail with branch estates — central backup of branch POS, M365 / Workspace protection, central restore capability into branch infrastructure.
How a London backup engagement runs
Assessment + design — weeks 1–2
Existing-backup audit, RPO / RTO targets per workload, ransomware scenario stress-test of the current design, regulator-mapping if applicable. Output is a sized design and a 12-month implementation plan.
Hardware + software deployment
Backup repository hardware racked in agreed London DC (Telehouse, Equinix, VIRTUS) or branch site, software deployed, replication configured, immutability + air-gap configured, monitoring integrated.
First successful restore — week 6
No backup design is signed off until a real restore has succeeded. We pick a non-critical workload, restore end-to-end to isolated infrastructure, document the timing and the result, hand the evidence to the customer.
Ongoing operations + quarterly testing
Day-to-day job monitoring, restore-on-demand for tickets, quarterly tested restore exercises documented for audit. For regulated customers we run a yearly DR table-top with the customer's leadership team.
London backup + recovery — common questions
What does "immutable" actually mean for our backup data?
Immutable backup is data that even an admin with full credentials cannot delete or modify before its retention period expires. We achieve this via object-lock on AWS S3 / Azure Blob / on-prem object storage; via Veeam Hardened Repository (single-use Linux account, no SSH); via Rubrik immutable-by-default architecture; via Commvault Air Gap Protect. For FCA / SRA customers, immutability is not optional — ransomware actors specifically target backups, and a non-immutable backup is one breach away from useless.
How do you protect a Microsoft 365 tenant — Microsoft does it, surely?
Microsoft retains, they don't back up. Their default retention is short, their restore granularity is limited, and a deleted / corrupted / encrypted item past the retention window is gone. For any London tenant of meaningful size we deploy a third-party M365 backup tool (Veeam for M365, Druva inSync, AvePoint Cloud Backup, Spanning) with independent retention, point-in-time restore, and tenant isolation from a ransomware-affected production estate.
Can you build us an air-gapped vault in a second London DC?
Yes — typical design lands the primary backup repository in one City DC (e.g. Telehouse North) and the air-gapped vault in a second London DC (Equinix LD8 or VIRTUS LONDON3) with network isolation, immutable storage, and credentials separated from the production estate. For larger customers we add a third tier — offsite or cloud archive — for the long-tail retention.
Do you do quarterly restore testing for a regulated customer?
Yes — for FCA, SRA, DSPT customers we schedule quarterly tested restores: pick a workload (rotated through the estate over the year), restore end-to-end to isolated infrastructure, validate integrity, time-box the operation against the customer's declared Impact Tolerance or RTO, document the result, file the evidence into the customer's audit pack.
How quickly can you recover a ransomware-encrypted London estate?
Depends on estate size and design but for a typical 200-VM estate with Veeam or Rubrik and immutable repositories: critical-service restore to isolated recovery infrastructure within 4–8 hours of incident declaration, full estate recovery 24–72 hours depending on data volume. The cleaner the design (immutability, air-gap, tested restores, documented runbook), the closer we are to the lower end.
How do you price backup for a 100-VM London firm?
Three components — software licence (Veeam / Rubrik / Commvault per VM or per TB), backup target hardware (typically £30–60k for a properly sized repository pair), implementation services (typically £15–35k for design + deployment + first successful restore). Annual support and quarterly restore testing on top. We model 3-year TCO on the first proposal.
Other services we deliver in London
Need London backup that holds up to a regulator review or a ransomware incident?
Send the workloads and the RPO / RTO you need. We'll come back with a sized design and a like-for-like comparison across 2–3 platforms.