Backup for Banks & insurers

Why Banks & insurers are extra vulnerable to data loss

What makes banks & insurers data a high-value target — and what happens when it's gone

Banks & insurers store some of the most sensitive data in their field — including customer financial records | transaction logs | insurance policies. This combination of confidential records, long statutory retention obligations, and day-to-day reliance on software like Salesforce Financial Services makes them a prime target for cybercriminals.

Ransomware groups increasingly target organisations that cannot afford downtime — and banks & insurers fit that profile exactly. A firm that loses access to its customer financial records cannot operate. Deadlines are missed, regulatory obligations are breached, and clients lose trust. Under DORA (Digital Operational Resilience Act), data must be retained for 7 years — meaning a data loss event does not just disrupt operations today, it creates legal liability that extends years into the future.

The risk is not abstract. Regulatory non-compliance fines, ransomware on transaction systems, data breach of customer financial data is the leading threat for this sector. Files with characteristics like highly structured databases | large transaction volumes are difficult or impossible to reconstruct from memory once lost. Every day without a verified, offsite backup is a day of unnecessary exposure.

• Banks & insurers
• Customer financial records
• ISO 27001

The misconception that costs many banks & insurers dearly

"Our core banking system is redundant, so we're covered — a separate backup is unnecessary overhead."

It is easy to understand why many banks & insurers believe this. Salesforce Financial Services is marketed as a professional-grade platform, and vendors naturally emphasise uptime and reliability. But there is a critical difference between redundancy and recovery. A system can be highly available and still offer you zero protection the moment ransomware encrypts your files or an administrator accidentally deletes a directory.

Synchronisation tools — including those built into Salesforce Financial Services — propagate changes in near real-time. When ransomware encrypts a file, that encrypted version immediately overwrites your 'backed up' copy. By the time the attack is discovered, every sync destination contains the same unusable data. This is not a backup. It is a perfectly synchronised disaster.

The practical consequence: without an independent, immutable backup, banks & insurers facing a ransomware attack have two options — pay the ransom or start over. Neither is acceptable when DORA (Digital Operational Resilience Act) requires you to demonstrate full data integrity to regulators.

What do I need to back up if I use Salesforce Financial Services?

The data banks & insurers typically overlook when using Salesforce Financial Services

Salesforce Financial Services manages your day-to-day workflow, but its built-in data protection typically covers only what happens within the application itself. It does not automatically back up your entire data environment — and there are several categories of data that fall outside its scope entirely.

For banks & insurers using Salesforce Financial Services, the following should be included in any proper backup: customer financial records, transaction logs, insurance policies, kyc/aml files. If you also use Temenos, any data in those systems must be covered separately.

Pay particular attention to highly structured databases | large transaction volumes. These file types are either difficult to reconstruct or subject to strict legal retention requirements. A backup strategy that does not explicitly cover them is incomplete — and potentially non-compliant.

• Banks & insurers
• Customer financial records
• Salesforce Financial Services

What a proper backup actually does

The 3-2-1 rule — and why it matters for banks & insurers

The 3-2-1 rule is the baseline standard for data resilience: keep at least 3 copies of your data, on 2 different types of storage media, with 1 copy stored offsite. For banks & insurers, this is not just best practice — it is increasingly a regulatory expectation under frameworks like DORA (Digital Operational Resilience Act).

In practice: your primary production data counts as copy 1. A local backup (on a NAS or secondary server) is copy 2, enabling fast recovery without waiting for a cloud download. Copy 3 is stored in an offsite data centre — physically and logically separated from your main environment, so a fire, flood, or ransomware attack cannot reach all three copies simultaneously.

Mindtime extends this to a 4-copy model, with an additional snapshot stored in a second Dutch data centre. For banks & insurers managing customer financial records, this means your data is always recoverable — from a clean, pre-attack restore point — regardless of what happens on-site.

How do banks & insurers protect themselves against ransomware?

Specific measures for banks & insurers — beyond antivirus

Ransomware attacks on banks & insurers typically follow a predictable pattern: initial access via a phishing email or compromised credential, lateral movement to identify high-value data, and then encryption of everything — including network shares and connected backup drives.

The single most effective defensive measure is an immutable offsite backup — one that ransomware cannot reach. Beyond backup, banks & insurers should implement: multi-factor authentication on all systems (particularly Salesforce Financial Services), regular software updates and patch management, network segmentation to limit lateral movement, and staff awareness training on phishing recognitions.

Critically, a backup is only useful if it has been tested. Many organisations discover during a recovery that their backup is incomplete, out of date, or corrupted. Mindtime performs automated integrity checks on every backup and alerts you if a backup fails — so you know your data is recoverable before you need it, not during a crisis.

How do I create a backup if I use Salesforce Financial Services?

A practical guide for banks & insurers using Salesforce Financial Services

Setting up a proper backup for banks & insurers using Salesforce Financial Services (and Temenos if applicable) involves more than activating the export function in your software. Here is the practical approach:

First, identify all data that must be retained under DORA (Digital Operational Resilience Act) — including customer financial records | transaction logs | insurance policies. Map every location where this data lives: within Salesforce Financial Services, on local drives, on shared network folders, and in any integrated third-party tools.

Second, configure Mindtime's agent on each endpoint and server that holds banks & insurers data. The agent performs incremental backups continuously, so you are never more than a few minutes behind your last recovery point. Backup frequency, retention periods, and encryption settings are all configured to meet your specific regulatory requirements.

Third, run a test restore within the first week. Verify that customer financial records and other critical data types can be recovered fully and within your acceptable downtime window. Document the process so your team knows exactly what to do if an incident occurs.

Data retention and compliance obligations for banks & insurers

DORA (Digital Operational Resilience Act) and what it means for your backup strategy

Banks & insurers operate under some of the most specific data retention obligations in their field. The primary framework is DORA (Digital Operational Resilience Act), which sets clear requirements for how long customer financial records must be kept, in what format, and with what level of accessibility.

Key retention requirements for banks & insurers:

— 7 years (fiscal)

— 5 years post-contract (Wft)

— Up to 10 years for AML files

Beyond retention duration, these regulations also require that data remains accessible and verifiable throughout the retention period. A backup that cannot be searched, exported, or audited does not satisfy the requirement. Mindtime's backup platform includes point-in-time restore, meaning you can retrieve any version of a file at any point within the retention window — exactly what regulators require during an audit.

Certification under ISO 27001 demonstrates that your data protection processes meet a recognised standard — which regulators and clients increasingly expect.

• Banks & insurers
• DORA (Digital Operational Resilience Act)
• ISO 27001

Five steps to get this sorted

A practical checklist for banks & insurers implementing a proper backup strategy

Your questions answered

Frequently asked questions about backup for banks & insurers