In this guide · 8 sections
Short answer
Use both. A Synology NAS gives fast local restores; a cloud copy protects against theft, fire and site-wide ransomware. Turn on immutable snapshots on the NAS, keep DSM off the open internet, and send an off-site copy to cloud storage such as Backblaze B2 (from US$6.95 per TB a month).
Synology NAS vs cloud backup at a glance
The real question isn't which is better, but which failures each one protects you from.
Synology NAS (on-site)
Fast restores- Restores a folder or a whole PC over the office network in minutes
- One-off hardware cost plus drives; no per-GB monthly fee
- Active Backup for Business can back up PCs, servers and cloud accounts
- Destroyed along with the office in a fire, flood or theft
- Ransomware risk if exposed to the internet or shared with weak admin passwords
Best for: Quick recovery from deletion, a failed laptop or a bad update.
Cloud backup or storage
Off-site safety- Survives anything that happens to the office
- Monthly cost that grows with data stored
- Object lock or immutability can stop deletion by attackers
- Large restores limited by internet speed
- Some providers charge for downloading (egress)
Best for: Disaster recovery and the off-site leg of 3-2-1.
For a wider view of providers and managed services, see our guide to choosing a backup service.
The 3-2-1 rule for a small office
The 3-2-1 rule is the simplest test of a backup plan. Synology's own ransomware prevention article tells users to follow it and to keep an offline, encrypted backup that is regularly test-restored.
| Copy | Where it lives | Protects against |
|---|---|---|
| 1. Live data | PCs, file server, Microsoft 365 or Google Drive | Nothing on its own |
| 2. Local backup | Synology NAS with snapshots | Deletion, failed drive, bad update, most ransomware on PCs |
| 3. Off-site backup | Cloud storage or a second NAS elsewhere, ideally immutable | Fire, flood, theft, ransomware that reaches the NAS |
Cloud apps count too. Files in Microsoft 365 or Google Workspace need their own backup; our Microsoft 365 and Google Workspace backup guide explains why sync and the recycle bin are not backups.
Ransomware and a NAS on the internet
Most mass NAS ransomware campaigns have one thing in common: the device was reachable from the internet. Synology's guidance is direct: don't expose DSM to the internet unless necessary, and if staff need files from outside, connect through a VPN.
Synology NAS hardening checklist
Immutable snapshots on Synology
Synology's immutable snapshot article (updated March 2026) describes them as WORM (write once, read many) snapshots that can't be changed or deleted during a protection period. Storage containing immutable snapshots can't be deleted either. Synology recommends a protection period of 7 to 14 days.
Install Snapshot Replication
From Package Center, install Snapshot Replication. Shared folders must be on a Btrfs volume.
Schedule snapshots
Under Snapshots, select the shared folder, open Settings, and enable a schedule, for example hourly during office hours and daily overnight.
Enable immutable snapshots
Tick Enable immutable snapshots and set a protection period of 7 to 14 days. During that period, nobody can delete them, including an admin.
Set retention
Keep enough snapshots to cover the protection period plus a margin, and check free space; snapshots use disk space as files change.
Test a restore
Restore a test folder from a snapshot and record how long it took.
Immutable snapshots protect against deletion through DSM, but not against the NAS itself being stolen or destroyed. You still need the off-site copy.
Cloud backup costs and egress
Cloud storage for backups is cheap per terabyte, but check the download charges before you rely on it for a full restore.
- Backblaze B2 storage, 2 TBUS$6.95 per TB a month, pay as you goAbout US$13.90/month
- Downloads (egress)Per Backblaze's pricing pageFree up to 3x stored data
- Minimum storage durationBackblaze lists no minimum file size or duration feesNone
- Synology Hyper Backup to B2Hyper Backup is a DSM packageNo extra software cost
Estimated off-site cost for 2 TBAbout US$167 a year
Approximate, from Backblaze's B2 pricing page as of October 2026, in USD before GST. Your data volume and retention change the total.
Source: Backblaze B2 pricing. Synology also sells its own C2 cloud storage, which its pricing page says has immutability and no egress or API charges. Compare current prices before choosing; both change.
The hybrid set-up most small offices need
For an office of 5 to 30 people with a Synology NAS, this layout covers the common failures without a large budget.
- PCs and laptops back up to the NAS with Active Backup for Business, or keep files in OneDrive or Google Drive.
- Microsoft 365 or Google Workspace backed up separately (to the NAS or a cloud backup service).
- Immutable snapshots on the NAS's shared folders, 7 to 14 days.
- Nightly Hyper Backup of the NAS to cloud storage with object lock or immutability turned on.
- No direct internet exposure; VPN for remote access.
- A restore test every quarter, written down: what, how long, who did it.
If ransomware does get in, our ransomware response guide covers the first hour.
Do it yourself or get help?
Turning on snapshots and a cloud copy takes an afternoon if you are comfortable in DSM. Help is worth it when the NAS has been running for years with port forwarding, shared admin passwords or no tested restore, because fixing those without breaking staff access needs care.
Our Backup & Ransomware Recovery service (S$290) sets up the 3-2-1 plan: NAS hardening, immutable snapshots, an immutable off-site copy, Microsoft 365 or Google Workspace backup, alerts and a first documented restore test.
Frequently asked questions
Not on its own. A NAS in the office protects against deleted files and failed laptops, but not fire, flood, theft or ransomware that reaches the NAS itself. Add an off-site copy, ideally immutable, in cloud storage or on a second device at another location, to meet the 3-2-1 rule.
Synology advises against exposing DSM to the internet unless necessary, and recommends a VPN if staff need file access from outside. Most NAS ransomware campaigns target internet-facing devices. If you must allow remote access, use a VPN, MFA on all accounts and automatic security updates.
It is a point-in-time copy that can't be changed or deleted until its protection period ends, even by an administrator. Synology describes its immutable snapshots as WORM-based and recommends a 7 to 14 day protection period. They let you roll back after ransomware encrypts files on the NAS.
Backblaze B2 lists storage from US$6.95 per TB a month as of October 2026, with free downloads up to three times the data stored. So 2 TB costs about US$14 a month before GST. Synology C2 is another option. Check retention settings, because keeping many versions increases stored data.
Cloud-only is simpler and survives anything that happens to the office, but restoring several terabytes over an office connection can take days. A NAS restores in minutes. For most offices, the NAS handles everyday restores and the cloud copy handles disasters; using both is the safer choice.