A Backup Strategy for a Small UAE Business: 3-2-1 in Practice

Small businesses in the UAE lose data the same way everywhere else does - a failed SSD in a five-year-old billing PC, a stolen laptop from a locked office, an accidental format during a Windows reinstall, ransomware from a pirated Office installer, an AC leak over a POS counter. The difference here is the paperwork afterwards. Under UAE VAT law you must be able to produce tax invoices, credit notes, and the underlying accounting records on demand, and keep them for five years (fifteen for real estate). If your only copy of the last three years of sales was on the drive that died on a Thursday afternoon, the FTA does not care that your IT guy is on leave.

This guide walks through a backup plan that a shop owner, a restaurant manager, or a trading company accountant can actually run without a full-time sysadmin. It is written around the 3-2-1 rule that every serious IT team follows, adapted to the reality of a UAE SME running an on-premise ERP or POS on a single PC or a small LAN.

Before choosing tools, be honest about what you are protecting. In a typical small UAE business running an offline-first ERP like Zeyto, four things matter, in this order.

First, the operational database - the PostgreSQL data directory or a logical dump of it. This is your ledger, your customers, your items, your stock balances, your invoices, and your VAT audit trail. Losing it is losing the business's memory. Second, uploaded files and print templates - scanned trade licences, supplier invoices, signed delivery notes, custom invoice layouts, company logo, and the letterhead the accountant spent a weekend designing. Third, configuration - the licence file (.zlic), any environment settings, the list of users and their roles, printer mappings, and integration keys. Fourth, and often forgotten, the install media itself - the exact ERP binary version you were running, so a restore lands on a compatible engine instead of a newer one that migrates the schema before you have taken a fresh dump.

Zeyto is offline-first by design, so backup is treated as a first-class function of the product rather than an IT afterthought. Every install ships with a scheduled local backup that dumps the PostgreSQL database on a cadence the owner sets, writes to a configurable folder, and rotates old copies automatically. A second target can be added - typically an external drive or a LAN path - to satisfy the 2-different-media half of 3-2-1 without any scripting.

For the off-site copy, Zeyto Cloud offers optional encrypted backup. The database dump is encrypted on the local machine before it leaves, uploaded over an outbound-only HTTPS connection, and stored against the licence. If the shop PC is stolen tomorrow, a partner can reinstall the binary on new hardware, activate the same .zlic licence, and pull the latest encrypted dump down to restore. The cloud never holds a decryptable copy of your books - only the encrypted blob and enough metadata to find it again. Restore is a guided flow in the product, not a command-line ritual, and it defaults to restoring into a scratch company first so you can verify before overwriting live data.

None of that removes the owner's responsibility to actually test a restore. It just removes the excuses.

Small UAE businesses are not too small to be targeted. Most ransomware is untargeted - it lands through a phishing email, a pirated software installer, or a browser exploit, and encrypts whatever the logged-in user can write to. If your backup drive is permanently mounted with a drive letter and the shop user has write access to it, the ransomware has write access to it too. Mitigations that actually work: at least one backup copy on media that is offline most of the time (a drive that is only plugged in during the backup window, then removed), an off-site copy on storage that requires separate credentials the shop PC does not have cached, and versioned retention so yesterday's encrypted files do not overwrite last week's clean ones.

UAE VAT legislation requires taxable persons to keep accounting records, tax invoices, credit notes, and import/export documents for five years from the end of the tax period they relate to - fifteen years for real estate. That is a retention requirement, not a backup requirement, but the two collide in practice. Your rolling 14-day or 30-day backup will not satisfy a request from the FTA for records from four years ago. Somewhere in the plan you need a long-term archive: a monthly or quarterly copy that is set aside and not overwritten. Zeyto's report exports and PDF invoice archives make this easier because the archived artefacts are readable without the ERP - but the safest position is to keep both the database dump and the exported PDFs of the period's tax invoices, VAT return workings, and the FTA-format sales and purchase registers.