Walk into any urban IT consultancy and they'll tell you the modern best practice for backups: "Everything to the cloud, immutable retention, restore from anywhere." It's good advice for a Toronto law firm with symmetrical gigabit fibre and a generous monthly bandwidth allocation.
It's not good advice — or even practical advice — for a 30-seat trucking operation outside Fort Vermilion with 50 Mbps download, 10 Mbps upload, and a Starlink terminal that's their only resilient connectivity option.
The strategies in this article are what we actually deploy for rural Alberta clients: the constraints, the realistic options, and the trade-offs that matter when the assumption of fast, cheap upload bandwidth doesn't hold.
Why bandwidth changes the calculation
A typical small-business backup needs to move two categories of data:
- Initial seed: the existing data set, often 500 GB to 5 TB, that must reach the backup destination before anything else can happen
- Daily delta: the changes since the previous backup, typically 5 GB to 50 GB per day
At urban fibre speeds (500 Mbps symmetric or better), seeding 2 TB takes about 9 hours. Daily deltas are inconsequential. You can re-architect your entire backup strategy as a thought experiment.
At rural Alberta speeds (10 Mbps upload on a good day), seeding the same 2 TB takes about 19 days of continuous uploading — and that's if nothing else is using your connection, which it definitely is. A 30 GB daily delta takes seven hours. If your business hours need that bandwidth for actual work, your backup window collapses to overnight, and overnight isn't enough for many businesses.
This single fact reshapes everything downstream.
The realistic architecture: hybrid, not pure-cloud
The architecture that works for rural businesses is hybrid local + cloud, sometimes called "3-2-1 with a local appliance":
- Local backup appliance holds the primary recoverable copy (fast restores, no bandwidth pressure)
- Cloud backup target holds the off-site copy required for ransomware resilience and disaster recovery
- Replication from local to cloud happens continuously in the background, throttled to avoid saturating the connection
This costs more upfront than a pure-cloud strategy (the local appliance hardware is $1,500 to $5,000 depending on capacity) but the operational reality is dramatically better:
- Daily backups complete in minutes, not hours, because they go local-first
- Restores happen at LAN speed, not internet speed — a 50 GB file restore in 10 minutes instead of 10 hours
- Cloud replication catches up during off-peak hours without interfering with business operations
- Ransomware resilience preserved because the cloud copy is still off-site and immutable
The local appliance is not optional in rural settings. It's the architectural choice that makes the entire strategy work.
Vendor options that work rurally
We've tested most of the major SMB-tier backup vendors in rural Alberta conditions. The ones that work well:
Cove Data Protection (N-able). Our default recommendation for rural SMB. Cove supports a local appliance model out of the box, includes immutable cloud retention, M365 SaaS backup, and endpoint backup in the same console. Per-GB pricing rather than per-seat — cost-effective for businesses with concentrated data.
Datto SIRIS or ALTO. The premium option. Excellent local appliance, instant virtualization for failover, very strong restore performance. More expensive than Cove (often 2-3×), but the appliance hardware is purpose-built and the restore experience is unmatched in this market.
Veeam with Wasabi storage backend. For businesses that want to architect their own solution with maximum flexibility. Veeam handles the backup software side, Wasabi provides cheap immutable cloud storage. More setup effort, lower ongoing cost, more flexibility.
What we don't recommend for rural SMB:
- Carbonite Endpoint / Mozy / similar pure-cloud endpoint backup products. They assume bandwidth that doesn't exist out here.
- Acronis Cyber Protect. Capable product but the licensing model and operational complexity rarely fit a 30-seat rural business.
- Microsoft 365's native retention as your only M365 backup. Microsoft will tell you this isn't a backup. They're right. It isn't.
The Starlink consideration
Many rural businesses we work with use Starlink as their primary or sole internet connection. Starlink works well for backups, with a few specific caveats:
- Upload bandwidth is asymmetric. Starlink advertises symmetric performance but the upload is generally 10-30 Mbps in our experience, against 100-300 Mbps download. Plan backup architectures around the upload number, not the download.
- Bandwidth varies by time of day. Starlink throttles heavy users during peak hours (typically 6 PM – midnight). Scheduling cloud replication outside these hours improves throughput significantly.
- Single point of failure. Starlink terminals do go offline. For BCDR-critical workloads, having a secondary connection (LTE failover, wireless ISP) for the period when Starlink is down is increasingly affordable and worth budgeting.
We've seen rural businesses successfully back up 500 GB-2 TB environments to cloud entirely over Starlink — but only with hybrid local-first architectures and realistic scheduling.
What about the air-gapped requirement?
Cyber-insurance carriers and security frameworks increasingly require an "immutable" or "air-gapped" copy of backups — a copy that cannot be encrypted by ransomware that has admin credentials in your environment.
For rural businesses, three practical options:
Option A: Cloud immutability. Most modern cloud backup products (Cove, Datto, Veeam-with-Wasabi) offer immutable retention by default. The cloud copy is your air-gap. This is usually the right answer.
Option B: Removable media rotation. Old-fashioned but still works. External hard drives or LTO tape, rotated weekly to an off-site location (often the business owner's home). Cheap, simple, no bandwidth required. The trade-off is operational discipline — somebody has to actually rotate the media every week, and "we got busy" means the backup is no longer current.
Option C: A secondary on-prem appliance at another location. If you have a satellite office, a partner's office, or even the owner's home with reasonable connectivity, a second backup appliance there can serve as your off-site copy. More expensive than the cloud option, but lower ongoing fees and faster off-site restore.
For most rural SMB clients we recommend Option A (cloud immutability via Cove or Datto). Operationally simplest, scales with data growth, no manual rotation required.
The 5-minute backup health check
Three questions every business owner should be able to answer right now:
-
What is your recovery point objective? That is: if everything ransomware'd at 3:00 PM today, what's the latest backup you could restore from? An honest answer is "yesterday's end-of-day" or "three days ago" — not "I'm not sure."
-
What is your recovery time objective? That is: how long would it take to restore your business to operational state? An honest answer for a 30-seat rural business with hybrid local+cloud backups is 4-12 hours. If your answer is "we'd be down for a week," you have a backup architecture problem.
-
When did someone last test a restore? This is the question that fails most assessments. "We have backups" is not the same as "we know the backups work." The answer should be "within the last 90 days" and there should be documented evidence.
If any of these three answers makes you uncomfortable, your backup architecture is your highest cybersecurity priority — higher than EDR, higher than MFA, higher than awareness training. Without working tested backups, every other layer of security is a single ransomware incident away from being undone.
What we deploy
Peace Country Cyber's managed backup service (bundled with our Cyber Essentials tier for M365 SaaS data, or with Tier 2 / Tier 3 for full endpoint and server backup) uses Cove Data Protection by default. Hybrid local + cloud architecture, immutable retention, restore tests included quarterly, monthly success-rate reporting.
Pricing scales by data volume and seat count. For a typical 30-seat rural business with 1-2 TB of business data, expect $300-600 per month all-in including the local appliance amortized.
What matters more than the vendor or the pricing: your backups are tested, immutable, and recoverable in your actual bandwidth conditions. Get that right and you've eliminated the single biggest cause of catastrophic ransomware outcomes for rural SMBs.
Peace Country Cyber is northern Alberta's local cybersecurity partner. Take the free Security Risk Report →