Creative & technical
Backup for SaaS providers and software developers
Mindtime backs up your production databases, Linux servers and AWS, Azure or Google Cloud workloads to immutable storage in its own data centres in the Netherlands and Germany. That gives you a copy outside the cloud account and the pipeline that could break it.
In Dutch, German or English.
- NL · DEStored only in our own Tier III data centres in the Netherlands and Germany
- ImmutableObject Lock storage plus an air-gapped copy; every backup job is checked
- ISO 27001 · NEN 7510Audited security, with a data processing agreement in every contract
- NL · DE · ENSupport from people, no offshore call centres or chatbots
In short
SaaS providers need backups outside their own cloud account, because a dropped table, a leaked credential or a bad deploy can destroy the customer data you are trusted with. Mindtime keeps immutable copies of databases, Linux servers and AWS, Azure or Google Cloud workloads in its own Tier III data centres in the Netherlands and Germany, with an air-gapped copy.
What's at stake
The data software developers and SaaS providers can't afford to lose
Production databases
Your customers' records, settings and history live in PostgreSQL, MySQL or SQL Server. A migration run against the wrong environment can erase them in seconds, and replicas copy the mistake faithfully.
Source code and build history
Repositories, CI pipelines and release artefacts are how you rebuild and patch the product. Losing a self-hosted Git server means losing more than the code.
Configuration, keys and infrastructure state
Encryption keys, secrets files and infrastructure definitions are easy to forget. Without them, restored data may be unreadable or the platform cannot be rebuilt.
Rules and obligations
What the rules ask of software developers and SaaS providers
Summarised from the sources listed at the bottom of this page. This is general information, not legal advice.
Cloud computing services fall under NIS2
The Cyberbeveiligingswet, the Dutch NIS2 law, lists cloud computing services in the digital infrastructure sector. The RDI supervises that sector, and in-scope providers must arrange backup management and recovery plans as part of business continuity. [1]
Medium-sized and larger providers are in scope
The size criteria are 50 or more employees, or fewer employees with both turnover and balance sheet total above €10 million, counting partner and linked companies. A small SaaS start-up is usually below them; the RDI self-assessment confirms it. [4]
Cyber Resilience Act: reporting since 11 September 2026
Manufacturers of products with digital elements, including software such as apps, must now report actively exploited vulnerabilities and serious incidents, with an early warning within 24 hours. Most other CRA requirements apply from 11 December 2027. [5]
Financial customers must assess you under DORA
Under DORA, financial entities must map which IT suppliers they use and how resilient those suppliers are. If banks or insurers use your software, expect detailed questions about your backup and recovery. [8]
You are your customers' processor
When your platform processes personal data for customers, you act as their processor under a processing agreement, and you must inform them as soon as possible after a data breach. [9]
When it goes wrong
A migration aimed at the wrong database
Illustrative example: a developer at a small SaaS company runs a clean-up migration against production instead of staging, and a table of customer invoices disappears. The read replica follows within moments, and the cloud provider's snapshots sit in the same account the developer's credentials can reach. The team restores the database from Mindtime's immutable copy into an isolated environment, compares it with the live system and puts back only the missing rows. They then inform the affected customers as their processor and review who may run migrations on production.
How Mindtime protects it
Backup for software developers and SaaS providers, workload by workload
- Database backupCustomer data in PostgreSQL, MySQL or SQL Server is the part of a SaaS product that cannot be rebuilt from code.
- Linux server backupApplication, Git and CI servers mostly run on Linux, with configuration that is easy to lose.
- AWS backupA copy outside your AWS account protects against deleted resources and leaked credentials.
- Azure backupAzure-hosted products need a backup that does not depend on the same tenant and permissions.
- Google Cloud backupTeams on Google Cloud get an independent copy in the Netherlands and Germany.
- Disaster RecoveryCustomers expect the service back quickly, and standby infrastructure gives you somewhere to run it.
The software you use, and what we protect around it
| GitLab Self-Managed | GitLab's own backup excludes configuration and secrets files such as gitlab-secrets.json, which you must back up separately. If GitLab runs on your own Linux server, Mindtime backs up the whole server, configuration included. |
|---|---|
| GitHub | Repositories are hosted by GitHub, which documents a mirror clone as one way to take your own backup. Keep that mirror on a server Mindtime backs up, and check GitHub's terms for what else it retains. |
| Jira and Confluence (Atlassian Cloud) | Specifications and tickets live with the supplier. Check Atlassian's export and retention terms; Mindtime protects the mail, laptops and servers your team works with around it. |
| PostgreSQL, MySQL and SQL Server | Whether on your own servers or virtual machines in the cloud, Mindtime backs up the database servers that hold your customer data. |
| AWS, Azure and Google Cloud | Mindtime backs up workloads in these clouds to its own data centres, so a copy exists outside the account that runs production. |
Before you switch
What software developers and SaaS providers ask us first
Our cloud provider already takes snapshots.
Snapshots usually live in the same account, so a leaked key or a careless script can delete them along with production. Mindtime keeps immutable copies in its own data centres and an air-gapped copy, outside your cloud account.
We have replicas in two availability zones.
Replication protects against hardware failure, not against bad writes: a dropped table is dropped everywhere. You need a point-in-time copy that cannot be changed, which is what an immutable backup gives you.
Our customers will ask where backups are stored.
You can answer precisely: in Mindtime's own Tier III data centres in the Netherlands and Germany, under a data processing agreement, with ISO 27001 and NEN 7510 audits. That is useful in security questionnaires from European customers.
FAQ
Questions about backup for software developers and SaaS providers
Why back up a SaaS platform outside the cloud it runs on?
Because the biggest risks come from inside the account: a mistaken command, a compromised deploy key or an attacker with admin rights. A copy in a different provider's data centres, immutable through Object Lock and with an air-gapped copy, is out of reach of all three. Mindtime checks every backup job and monitors around the clock.
Does NIS2 apply to our SaaS company?
It can. The Cyberbeveiligingswet, in force since 15 August 2026, lists cloud computing services under digital infrastructure, and providers that meet the size criteria must register, manage risks including backup and recovery, and report significant incidents. Use the RDI self-assessment to check, then see Mindtime's NIS2 page for the backup part.
Does the Cyber Resilience Act cover SaaS?
The CRA covers products with digital elements, including installable software such as apps. Whether a pure SaaS service falls under it depends on how it is delivered, and the official Dutch guidance we checked does not settle that. If you also ship apps, agents or on-premise software, the reporting duty since 11 September 2026 applies to you.
Can we test a restore without touching production?
Yes. Mindtime restores into an isolated environment, so you can inspect a database or server before anything goes back into production. If you add disaster recovery, a first test failover typically takes place within 10 days of starting, followed by DR tests every quarter, which also gives you evidence for customer audits.
We need something more tailored. Is that possible?
Yes. For larger or unusual environments, Mindtime works with the IT22 development team within Group22 on custom solutions. Start with a free 15-minute demo to walk through your architecture, and talk to Mindtime's own staff in Dutch, German or English rather than a chatbot or an offshore call centre.
See it with your own data
Book a 15-minute demo
We show you a backup and a restore, and answer your questions in Dutch, German or English. No offshore call centres, no chatbots.