How Should Construction Companies Back Up Jonas, Microsoft 365, SQL Databases, and Project Files?

Each of these needs a different backup method, and the most common gap is Microsoft 365, which most companies assume Microsoft backs up for them. Microsoft does not. The working standard is three copies of your data on two types of media with one copy off-site and immutable, application-aware backups for Jonas and SQL rather than plain file copies, a third-party backup for Microsoft 365, and a restore test you actually run at least quarterly.

Construction companies usually have four very different kinds of data, and treating them as one backup job is where things break. An ERP database, a cloud productivity suite, large CAD and project files, and photos scattered across phones all fail differently and recover differently.

Here’s what each one actually needs.

Jonas, Sage 300 CRE, Viewpoint, and the SQL database underneath

Your accounting and project management system almost certainly sits on a SQL Server database, whether it’s on a server in your office or hosted. It needs an application-aware backup, not a file copy. A running database written to disk mid-transaction produces a file that often won’t mount at all on restore.

What that means in practice:

The backup coordinates with SQL Server so the database is captured in a consistent state
The transaction log is captured too, which is what allows a point-in-time restore. Without it, your only option is “restore last night” and re-key everything since
The backup runs often enough to match how much data entry you’re willing to redo. For a company doing daily payables and payroll, nightly-only is usually too coarse

If you’re running one of these platforms and want context on supporting them day to day, see our notes on Jonas and construction software support.

Microsoft 365, the gap almost everyone has

Microsoft operates under a shared responsibility model. They guarantee the service stays available and that they don’t lose your data through their own infrastructure failure. Recovering your data after your own people delete it, or after ransomware encrypts it, is your responsibility.

The retention windows people mistake for backups are deletion grace periods:

Exchange Online: deleted items sit in Recoverable Items for 14 days by default, extendable to 30
SharePoint and OneDrive: first and second stage recycle bins total 93 days
A departed employee’s OneDrive: retained 30 days by default after the account is deleted

Past those windows, it’s gone. And none of them help when a compromised account’s files are encrypted and the encrypted versions sync to the cloud looking like legitimate changes. A third-party Microsoft 365 backup with its own retention is the fix, and it covers Exchange, SharePoint, OneDrive, and Teams.

CAD, drawings, submittals, and project files

These are large binary files with no transaction log, which changes the priorities. You cannot replay them forward, so the questions are versioning and retention depth.

The failure mode here is rarely a dramatic outage. It’s someone overwriting a drawing set, or a file quietly corrupting, and nobody noticing for six weeks. If your retention only reaches back 30 days, the good version is already expired. Keep enough version history to reach back past a mistake that went unnoticed for a while, and make sure the backup covers the actual working location, whether that’s a file server, SharePoint, or a document management system.

Jobsite photos and field-captured data

Photos on a superintendent’s personal phone are not backed up and are not really the company’s. That matters most in a dispute over what was built when, which can surface years later. Get them routed to a company OneDrive or SharePoint location automatically, and they fall under the normal backup like everything else.

The rules that tie it together

Three, two, one. Three copies of the data, on two different types of storage, with one copy off-site. This is the baseline standard, not an aspiration.

One copy immutable. Immutable means the backup cannot be altered or deleted for a set retention period, even by an administrator account. Ransomware crews target backups first, and a backup an admin credential can delete is a second target rather than a recovery plan. This is also a question on nearly every cyber insurance application now.

Set your targets before you buy anything. Decide how long the business can run without each system, and how much data entry you’re willing to redo. Those two numbers determine the design. Picking a backup product first and discovering the recovery time afterward is backwards.

Test restores on a schedule. Quarterly at minimum for the systems that stop work. Test the restore, not the green checkmark on the backup job. Most backup failures are only discovered during the emergency they were supposed to prevent.

Where construction companies most often come up short

In our experience across Houston and Dallas-Fort Worth, the same three gaps repeat: Microsoft 365 with no real backup at all, an ERP database being file-copied rather than backed up application-aware, and a backup that has never once been restored. All three are fixable in weeks.

If you want to know where you actually stand, our backup and disaster recovery service starts by inventorying what’s covered today versus what everyone assumes is covered, and our broader managed IT support keeps the restore testing on a schedule rather than leaving it to whoever remembers.

Not sure what's actually being backed up?

Tell us what you run, Jonas or Sage or Viewpoint, on-premise or hosted, and roughly how many users and jobsites. We'll tell you what's covered today, what isn't, and what a real restore would look like.

FAQs

Doesn't Microsoft back up Microsoft 365 for us?

No, and this is the single most common gap we find. Microsoft guarantees the service is available, not that your data is recoverable. Their retention windows are deletion grace periods, not backups: Exchange Online holds deleted items in Recoverable Items for 14 days by default (extendable to 30), SharePoint and OneDrive recycle bins total 93 days, and a deleted user's OneDrive is kept 30 days by default. Past those windows the data is gone, and none of them protect you from a ransomware encryption that syncs to the cloud.

Can we just copy the Jonas or Sage database file to a backup drive?

Not while it's running. A live SQL database file copied mid-write is usually unusable on restore. You need an application-aware or SQL-aware backup that quiesces the database and captures the transaction log, which is also what lets you restore to a point in time rather than only to last night.

How often should we actually test a restore?

At least quarterly for the systems that stop work if they're down, meaning your accounting or ERP database and your project file share. Test the restore, not the backup job's green checkmark. A backup that has never been restored is an assumption, and cyber insurance applications now ask specifically when you last performed one.

What about CAD and project files that are huge?

Back them up with versioning and enough retention to reach back past a mistake nobody caught for a month. Large binaries are the files most likely to be silently overwritten or corrupted, and unlike a database they have no transaction log to replay. Retention length matters more here than backup frequency.

Our superintendents keep jobsite photos on their phones. Is that a backup problem?

It's a data problem before it's a backup problem. Photos that only exist on a personal phone aren't backed up, aren't yours if the person leaves, and aren't available if a dispute over work performed comes up two years later. Route them into a company OneDrive or SharePoint location, then the normal backup covers them.

What's a realistic recovery time for our accounting system?

It depends on how the backup is stored, which is exactly why you set the target first. Decide how long you can run without Jonas or Sage, then build to that number. A local copy plus an off-site immutable copy typically means hours, not days, but that has to be designed deliberately rather than assumed.