Off-site is the hardest part of 3-2-1, and the cloud is the easy answer to it. For people who'd rather not put their data on someone else's servers — whether for professional obligation, regulatory reasons, or simple preference — the alternatives are all workable and all involve some manual effort.
Here they are, honestly compared.
First: what off-site is actually for
One copy, in a different physical location, so that fire, flood, theft, or a burst pipe doesn't take everything.
The distance required is smaller than people assume. A relative's house across town covers almost every realistic scenario. You're protecting against events that affect a building, not a region.
Option 1: Drive rotation
Two external drives. One is at home, backing up. The other is somewhere else. You swap them on a schedule.
How it works:
- Drive A at home, receiving automated backups
- Drive B at your workplace, a relative's house, or a friend's
- Monthly, swap them: bring B home, take A out
Cost: two drives, once. No subscription.
Strengths: total control, no third party, works on any internet connection, no ongoing cost, and one copy is always offline — which defeats ransomware.
Weaknesses: it depends entirely on you doing the swap. The off-site copy is only as current as your last trip. If you swap monthly, you're accepting up to a month of data loss in a disaster.
Making it work:
- Encrypt both drives. A drive that lives elsewhere is a drive you don't physically control. Store the password in your password manager.
- Set a recurring calendar reminder, not a good intention.
- Label them clearly — "BACKUP A" and "BACKUP B" with dates.
- Attach the swap to something you already do. Sunday lunch at your parents', the first working Monday, whatever's already in your routine.
- Verify each drive when you swap it. Plug it in, open a file. Thirty seconds, and it catches a failing drive before it's your only copy.
This is the best option for most people who want to avoid the cloud. It's cheap, it's simple, and the only failure mode is forgetting.
Option 2: Encrypted backup to the cloud
Worth including, because "I don't trust the cloud" is often really "I don't want a company able to read my files" — which is a solvable problem rather than a reason to avoid off-site storage entirely.
If you encrypt your data before it leaves your machine, the provider stores an unreadable blob. They can't read it, can't hand it over in readable form, and a breach on their side exposes nothing.
Two routes:
A backup tool with client-side encryption. Several backup applications encrypt with a key you hold before uploading, and can target generic object storage or a range of providers. You choose where it goes; they can't read it.
A zero-knowledge backup or storage provider, where end-to-end encryption is the default and the provider holds no key.
Cost: subscription or per-gigabyte, generally modest for the volumes most individuals have.
Strengths: fully automated, always current, geographically distant, no manual effort.
Weaknesses: you're still dependent on a company existing and on your connection. And if you lose the encryption key, the data is unrecoverable — genuinely, permanently. Store it properly and make sure someone you trust can reach it.
For a lot of people who describe themselves as not trusting the cloud, this is actually the right answer. The objection is to provider access, not to remote storage.
Option 3: A drive at a friend's or family member's, with remote sync
A step up from manual rotation: leave a network-attached drive at someone else's house and back up to it over the internet.
How it works: a small NAS or a computer with an attached drive at the remote location, connected over a VPN or the NAS manufacturer's own remote sync feature. Many consumer NAS devices support syncing to another unit at a different location as a built-in function.
Cost: two NAS units, or one plus a repurposed computer. A few hundred, once.
Strengths: automated, current, entirely under your control, no subscription, no third party reading anything.
Weaknesses: the most setup effort of any option. You're now responsible for two devices, their updates, their drives, and the network configuration. If the remote unit fails, you need to physically go and fix it. And you need a willing host with reliable power and internet.
Practicalities:
- Encrypt the remote unit. Your host shouldn't be able to read your data, and neither should anyone who takes it.
- Agree the arrangement clearly — what happens if they move, what electricity it uses, who touches it.
- Reciprocate. Host their backup on your unit. It makes the arrangement fair and durable.
- Keep it patched. A network device at someone else's house that you never update is a liability for both of you.
Good option for the technically confident. Overkill for most households.
Option 4: Safe deposit box or fireproof safe
A safe deposit box at a bank: a drive goes in, and you swap it periodically.
Strengths: genuinely secure, physically separate, protected from fire and theft.
Weaknesses: annual fee, limited access hours, and the swap is more effortful than a trip to a relative's — which means it happens less often. Realistically this becomes a quarterly or annual copy, not a monthly one.
Best use: not as your main off-site backup, but as the home for a small permanent archive. Identity documents, deeds, the encryption keys, a copy of the irreplaceable core. Things that don't change and that you'd need after a total loss.
A fireproof safe at home is not off-site and shouldn't be treated as such. It does help — fire-rated media safes exist specifically for drives and are worth having for a local copy — but a safe in a burgled or flooded house is still in a burgled or flooded house.
Option 5: Your workplace
If you have an office, a locked drawer there is a legitimate off-site location for a personal backup drive.
Strengths: you're there regularly, so swaps actually happen.
Weaknesses: check your employer's policy. Personal encrypted media at work is usually fine and occasionally isn't. And if you leave the job, you need to remember to retrieve it.
Encrypt it, obviously.
What to actually put off-site
You don't need to send everything.
The irreplaceable core is usually a few gigabytes to a few hundred: photos and video of people, documents, financial records, contracts, identity documents, business records, personal projects.
Everything else — software, media you could re-acquire, system files — can be replaced. Sending only the core makes every option above cheaper and faster, and makes a manual rotation genuinely quick.
Take an hour to identify your core. Most people are surprised how small it is, and it makes the whole problem tractable.
The comparison
| Cost | Effort | Currency | Control | |
|---|---|---|---|---|
| Drive rotation | Low, one-time | Monthly trip | Up to a month old | Total |
| Encrypted cloud | Subscription | None after setup | Continuous | High (they hold nothing readable) |
| Remote NAS | Medium, one-time | High setup, low after | Continuous | Total |
| Safe deposit box | Annual fee | Quarterly trip | Months old | Total |
| Workplace drive | Low | Weekly-ish | Days old | Total |
What I'd suggest
For most people avoiding the cloud: two encrypted drives, monthly rotation to a relative's house. Cheap, simple, sufficient.
For the technically confident: drive rotation plus encrypted cloud backup. Belt and braces, and the cloud copy covers the gap between swaps.
For a small business: encrypted cloud backup as the primary off-site, plus a quarterly archive drive in a safe deposit box for long-term retention.
For everyone: a small permanent archive of the truly irreplaceable, in a second physical location, updated annually. Even if you never do anything else, that one drive covers the scenario you'd most regret.
The failure mode to plan for
Every non-cloud option depends on you doing something manually, and manual things stop happening.
The realistic mitigations: a calendar reminder that repeats, attaching the task to something already in your routine, and a log file on the drive recording each swap date. When you plug it in and see the last entry was eight months ago, that's the correction.
An off-site copy that's a month old is excellent. One that's two years old is barely better than nothing, and it's the more common outcome.
Next in this series: How to Back Up Your Website and Online Business Data