The rule, and why it survives
Three recoverable copies, on at least two different kinds of storage, with one copy in a different physical location. The rule persists because each element removes a specific class of correlated failure.
Three copies handle individual corruption. Two storage types handle a technology or vendor failure. One offsite copy handles fire, flood, and theft. Removing any one leaves a gap the others do not cover.
Encryption adds a second failure domain
For encrypted backups the classic rule is necessary but not sufficient, because a copy you cannot decrypt is not a copy. The key or recovery phrase becomes a second thing that must survive, independently.
This is where most encrypted backup plans quietly fail. The data is redundant and the secret that unlocks it is not.
What does not count as a copy
Synchronised mirrors are not independent backups. If deleting or corrupting an item propagates to the other location, then both copies fail together and you have one copy stored twice.
Similarly, three backups all reachable only through the same account are one account away from being zero.
Building it deliberately
- Count the live vault plus every backup you have actually verified.
- Place copies on genuinely independent storage or providers.
- Move one copy away from the phone's physical location.
- Store the recovery phrase separately from every backup copy.
- Run periodic restores and record the date of the last successful test.
The three common breakages
- Counting synchronised mirrors as independent backups.
- Keeping the recovery phrase alongside the backup it unlocks.
- Never performing a full restore, so the whole arrangement is untested.
A fictional example
Sofia starts with a non-sensitive test: “Count the live vault plus every valid encrypted backup.” Next, Sofia follows the second check: “Place backup copies on independent storage or providers.” This fictional scenario demonstrates the decision process; it is not a report of product testing.
Common mistakes
- Counting synchronized mirrors as independent backups
- Keeping phrase and backup together
- Never testing a full restore
What this workflow does not change
- Counting synchronized mirrors as independent backups
- Keeping phrase and backup together
- Never testing a full restore
Questions people ask
Is cloud sync one of the three copies?
It can be, but only if deletion, account loss, and corruption are independently recoverable.
Should the backup phrase be photographed?
Avoid placing it in the same photo ecosystem or account as the encrypted backup.