For most insurance agencies, IDrive is the best overall backup choice: one subscription covers unlimited devices, encryption is AES-256 with a true private-key option, a HIPAA Business Associate Agreement is available, and Microsoft 365 backup is a published $20-per-seat-per-year add-on. Backblaze is the pick for agencies that want zero-thought simplicity, and Afi leads the separate but essential category of Microsoft 365 and Google Workspace backup. The one hard exclusion for PHI: Acronis True Image offers no BAA.
Why Backup Is a Compliance Obligation for an Agency, Not Just Good Hygiene
An insurance agency’s files are full of protected health information and personally identifiable data — enrollment forms, medical questionnaires, Medicare records. That puts backup under HIPAA, not just common sense: the Security Rule’s contingency-plan standard (45 CFR 164.308(a)(7)) requires covered entities and business associates to maintain a data backup plan and disaster recovery plan for ePHI. And because a backup vendor storing PHI is itself a business associate, HIPAA requires a signed Business Associate Agreement before your data reaches its cloud. BAA availability is therefore the first filter in this comparison, not a footnote.
The second thing to get right is the difference between sync and backup. Sync services — Google Drive, Dropbox, OneDrive — mirror files in real time, which means ransomware-encrypted files sync everywhere within seconds. Backup software takes timestamped snapshots and preserves versions, so a clean pre-attack copy always exists. During the 2023 Clop ransomware campaign, which affected more than 2,500 organizations, the ones with true backup software restored clean versions instead of paying ransoms (NextAgency resource article, retrieved July 2026). The standard discipline is the 3-2-1 rule: three copies, two storage types, one offsite — with periodic test restores.
Third: your cloud office suite needs its own backup. Endpoint tools protect computers, not Exchange mailboxes or shared drives, and Microsoft’s own services agreement recommends customers back up content stored in its services using third-party tools. That is why this comparison includes both endpoint products and cloud-to-cloud products (Afi, Backupify), plus the M365 add-ons from IDrive and CrashPlan.
Retention matters more in this industry than most: life and health producers face multi-year state record-retention requirements, so version history length and deleted-file retention are selection criteria, not nice-to-haves.
How We Evaluated These Backup Products
We evaluated products for an insurance agency with one to twenty staff and no IT department, using these criteria:
- HIPAA BAA availability. Whether the vendor signs a Business Associate Agreement, and on which plans.
- Encryption. AES-256 at rest, TLS in transit, and private-key options.
- Retention and versioning. Version depth and deleted-file retention against multi-year record obligations.
- Restore options. Web, application, and physical-media restore paths.
- Price and simplicity. Published pricing and realistic administration burden for a small office.
- Coverage model. Per-computer, per-user, or SaaS (M365/Workspace) protection.
1. IDrive
IDrive covers unlimited devices under one account — computers, phones, external drives, NAS, servers — making it the best single subscription for an agency with a handful of machines.
Strengths
- One subscription covers unlimited devices; storage is pooled rather than per-computer.
- AES-256 encryption in transit and at rest, with a true private-key option the vendor never stores.
- A documented BAA for Business, Team, and Enterprise customers with private-key encryption, alongside SOC 2 Type 2, ISO 27001, and GLBA attestations.
- Microsoft 365 and Google Workspace backup add-ons at a published $20 per seat per year.
- The largest review base in this comparison at strong ratings, and physical-drive shipping (IDrive Express) for large backups and restores.
Limitations
- Storage is capped, not unlimited — overage is possible on large media libraries.
- First-year discount pricing makes long-term cost easy to misread; renewals revert to standard rates.
- The interface is widely described in reviews as dated and cluttered.
- The private key cannot be changed after setup — and losing it means losing the backup.
Pricing
Personal plans from $11.99 per month for 5 TB on monthly billing, with annual billing roughly 30% less (5 TB shown at a $6.99-per-month first-year equivalent); Team plans from $11.99 per month; Business plans (unlimited users and devices) from $59.99 per month for 1.25 TB; server backup $5 per month per server; M365 and Google Workspace backup $20 per seat per year (vendor pricing page, verified July 2026). A free 10 GB tier requires no credit card.
Review Platform Data
G2: 4.4/5 (1,966 reviews, retrieved July 2026). Capterra: 4.6/5 (1,200 reviews, retrieved July 2026).
2. Backblaze
Backblaze Computer Backup is the simplest product in this category — unlimited storage per computer at a flat $99 per year, with a BAA available on request.
Strengths
- Truly unlimited storage per computer at a flat price, with near-zero configuration — the closest thing to set-and-forget in this list.
- A BAA is available on request, which is unusual at this price point; SOC 2 Type 2 audited.
- One-Year Extended Version History can be enabled at no charge, with Forever Version History available at $0.006 per GB per month for older versions.
- Physical restore drives ship for large recoveries, refundable on return.
Limitations
- One license covers one computer — no NAS, server, or network-drive backup on the Computer Backup product.
- Mac and Windows only; no Linux.
- Backup encryption is AES-128 rather than AES-256.
- Web restores temporarily decrypt data in Backblaze’s environment unless the private-key workflow is handled carefully.
Pricing
$99 per year per computer ($9 monthly, $189 for two years); Business is priced identically and adds a Groups admin console (vendor pricing page, verified July 2026).
Review Platform Data
G2: 4.4/5 (38 reviews on the Computer Backup listing, retrieved July 2026). Capterra: 4.7/5 (140 reviews on the Backblaze for Business listing, retrieved July 2026).
3. CrashPlan
CrashPlan pairs unlimited storage with unlimited versioning at a published per-user price — the strongest retention story in the endpoint group.
Strengths
- Unlimited storage and unlimited versioning at a published price — the deepest version history available here, valuable against multi-year record-retention obligations.
- A BAA on business plans, with HIPAA support requiring only that default encryption stay enabled; SOC 1, SOC 2, and ISO 27001 attested.
- Per-user licensing covers multiple machines per user, and Linux is supported — rare in this list.
- A Microsoft 365 backup companion at $4 per user per month.
- Continuous background backup every 15 minutes by default.
Limitations
- At $88 per user per year, it costs more than per-computer options for single-machine users.
- File-level backup only — no disk imaging for bare-metal recovery.
- Deleted-file retention defaults to 90 days and must be reconfigured for long retention obligations.
- No phone support at the SMB tier.
Pricing
Endpoint backup at $8 per user per month, $88 per user per year, or $158 per user for two years, with unlimited storage and versioning; Microsoft 365 backup at $4 per user per month with 50 GB pooled per user (vendor SMB pricing page, verified July 2026). A 14-day fully functional trial is available.
Review Platform Data
G2: 4.4/5 (415 reviews on the SMB listing, retrieved July 2026). Capterra: 4.4/5 (249 reviews, retrieved July 2026).
4. Afi
Afi is the transparent-pricing leader for the layer endpoint tools miss: Microsoft 365 and Google Workspace backup, at $3 per user per month with unlimited retention.
Strengths
- A published $3-per-user-per-month price with unlimited retention time and unlimited versions — the clearest value in SaaS backup.
- An openly published BAA template and HIPAA-compliant posture, with SOC 2 Type II audits.
- Immutable backup versioning and AI-based ransomware detection, with three-times-daily automated backups.
- The highest G2 rating in this comparison (4.8/5), granular restores with full-text search, and no-penalty cancellation.
- SharePoint sites and shared drives protected at no extra charge, and archived or departed users retained free without a license.
Limitations
- A five-user minimum means solo agents pay for five seats.
- SaaS-only: it does not back up computers at all — it complements, not replaces, an endpoint product.
- A smaller vendor with a shorter track record than incumbent competitors.
- Little third-party review presence outside G2.
Pricing
SaaS backup at $3 per user per month, five-user minimum, monthly or yearly billing, cancellable anytime (vendor pricing page, verified July 2026).
Review Platform Data
G2: 4.8/5 (55 reviews, retrieved July 2026). Capterra: Not listed with a current rating (checked July 2026).
5. Carbonite Safe
Carbonite Safe, an OpenText product, remains the beginner-proof choice with a defined HIPAA tier — undercut by the weakest versioning in this comparison.
Strengths
- Genuinely minimal configuration; among the easiest products here for a non-technical office.
- A BAA is available on request, with Safe Pro as the designated HIPAA-support tier and a third-party audit attestation of its HIPAA compliance program.
- Safe Pro covers up to 25 computers under one $287.99-per-year subscription — simple economics for a whole small agency.
- An established, long-running vendor.
Limitations
- Only the 12 most recent versions of a file are retained — the weakest versioning in this list, and a poor match for long retention obligations on frequently edited files.
- The vendor’s own buy page lists 128-bit encryption for the non-server tiers (256-bit is a server-tier option).
- Slower download speeds on large restores are reported.
- The lowest G2 rating in this category (4.0/5).
Pricing
Carbonite Safe at $95.99 per year, Safe Pro (up to 25 computers, the HIPAA-support tier) at $287.99 per year, and Safe Server at $599.99 per year (vendor buy page, verified July 2026). Free trials are offered on all tiers.
Review Platform Data
G2: 4.0/5 (197 reviews, retrieved July 2026). Capterra: 4.3/5 (172 reviews, retrieved July 2026).
6. Dropbox Backup
Dropbox Backup is included with every Dropbox plan — effectively free backup for agencies already paying for Dropbox, with retention limits to respect.
Strengths
- No extra cost if the agency already subscribes to Dropbox; backup, sync, and versioning ride on one bill.
- The BAA is self-serve: team-plan admins can execute it electronically from the Admin Console before uploading PHI.
- AES-256 at rest and TLS in transit, with an easy machine-migration workflow.
Limitations
- Not purchasable standalone — poor value if the agency doesn’t otherwise want Dropbox.
- Version history caps at 180 days on Standard and 1 year on Advanced — short next to dedicated backup tools, and a real constraint for record-retention obligations.
- Storage is pooled and capped, not unlimited.
- As a sync-centric platform it is exactly what the sync-versus-backup caveat warns about; the Backup feature mitigates but does not remove the versioning limits.
Pricing
Included in all Dropbox plans. Team plans: Standard at $15 per user per month billed annually (3 TB+ pooled) and Advanced at $24 per user per month billed annually (vendor plan pages, verified July 2026). Team plans carry a 30-day free trial.
Review Platform Data
G2: no standalone Dropbox Backup listing; the Dropbox platform holds 4.4/5 with tens of thousands of reviews across products (retrieved July 2026). Capterra: no standalone listing.
7. Backupify
Backupify, a Datto/Kaseya company, is the incumbent M365/Workspace backup — mature and BAA-ready, but quote-only pricing and an MSP-first sales motion make it awkward for a small agency to buy directly.
Strengths
- Mature, widely deployed Microsoft 365 and Google Workspace backup with unlimited cloud retention and three-times-daily snapshots.
- A BAA is available, on SOC 2 Type II-audited Datto private-cloud infrastructure.
- Granular, point-in-time restores across Exchange, OneDrive, SharePoint, Teams, Gmail, Drive, and Shared Drives.
- A strong MSP ecosystem if the agency outsources its IT.
Limitations
- No published pricing — quotes only.
- The product is MSP-channel oriented; buying direct is awkward for a three-person agency.
- Its G2 rating (4.2/5) trails Afi’s (4.8/5) in the same category, with reviewers citing support and restore-speed complaints.
- SaaS-only; endpoint backup is not included.
Pricing
Pricing is not published; contact sales is the only stated option.
Review Platform Data
G2: 4.2/5 (189 reviews, retrieved July 2026). Capterra: Not listed with a current rating (checked July 2026).
8. Acronis True Image
Acronis True Image is the strongest disaster-recovery tool here — full disk imaging plus anti-malware — but the absence of a BAA disqualifies its cloud for PHI, which is why it ranks last for this audience.
Strengths
- The only product in this list with full disk imaging and cloning — the fastest full-machine recovery after hardware failure, including restores to dissimilar hardware.
- Integrated anti-ransomware and anti-malware protection.
- Microsoft 365 backup included from the Advanced tier, and AES-256 encryption.
Limitations
- No BAA is offered or advertised for True Image — a hard stop for storing PHI in Acronis’s cloud for a HIPAA business associate. Agencies could use it for imaging non-PHI machines only.
- Cloud storage is capped and modest at lower tiers (50 GB on Advanced).
- More complex than the set-and-forget tools.
- The vendor’s own purchasing page displayed two different “from” prices for the Advanced tier on our retrieval date, making real cost confusing.
Pricing
Essentials at $49.99 per year (local backup only, no cloud), Advanced at $72.99 per year as displayed on the plan card (the same page’s comparison table showed “from $57.99” — both figures appeared; price varies by computer count) with 50 GB of cloud storage, and Premium at $124.99 per year with 1 TB (vendor purchasing page, verified July 2026). A 30-day free trial is offered.
Review Platform Data
G2: 4.3/5 (69 reviews, retrieved July 2026). Capterra: 4.3/5 (23 reviews, retrieved July 2026).
Comparison Table
| Criterion | IDrive | Backblaze | CrashPlan | Afi | Carbonite Safe | Dropbox Backup | Backupify | Acronis True Image |
|---|---|---|---|---|---|---|---|---|
| Covers | Unlimited devices | 1 computer/license | Per user, multi-machine | M365/Workspace only | Up to 25 computers (Pro) | Computers on Dropbox plans | M365/Workspace only | 1–5 computers |
| HIPAA BAA | Yes (Business/Team + private key) | Yes (on request) | Yes (business plans) | Yes (published template) | Yes (Safe Pro tier) | Yes (self-serve, team plans) | Yes | No |
| Encryption | AES-256 + private key | AES-128 + private key | AES-256 | AES-256, immutable | 128-bit (non-server) | AES-256 | In transit + at rest | AES-256 |
| Versioning | 30 versions | 30 days–forever (paid) | Unlimited | Unlimited | 12 versions | 180 days–1 year | Unlimited | Configurable |
| Entry price | ~$6.99/mo first yr (5 TB) | $99/yr/computer | $88/user/yr | $3/user/mo (5 min) | $95.99/yr | In Dropbox plans | Quote only | $49.99–$124.99/yr |
| G2 / Capterra | 4.4 (1,966) / 4.6 (1,200) | 4.4 (38) / 4.7 (140) | 4.4 (415) / 4.4 (249) | 4.8 (55) / Not listed | 4.0 (197) / 4.3 (172) | 4.4 (platform) / n/a | 4.2 (189) / Not listed | 4.3 (69) / 4.3 (23) |
Frequently Asked Questions
Isn’t Google Drive or Dropbox sync already a backup?
No. Sync services mirror files in real time across devices — if ransomware encrypts your files, the encrypted versions sync everywhere. Backup software creates timestamped snapshots preserving multiple versions, so you can restore a clean pre-attack copy. An agency needs both: sync for collaboration, backup for recovery.
Does HIPAA actually require an insurance agency to have backups?
Yes. The HIPAA Security Rule’s contingency-plan standard (45 CFR 164.308(a)(7)) requires covered entities and business associates to establish a data backup plan and disaster recovery plan for electronic protected health information. Agencies handling PHI as business associates fall under this requirement.
What is a BAA, and do I need one with my backup vendor?
A Business Associate Agreement is the written contract HIPAA requires before protected health information is disclosed to a vendor that will store or process it. A backup vendor holding your client files with PHI is a business associate, so the BAA must be in place before PHI touches its cloud. Backblaze, IDrive, CrashPlan, Carbonite, Dropbox, Afi, and Backupify all offer BAAs; Acronis True Image does not.
Do I need to back up Microsoft 365 or Google Workspace too?
Yes, separately. Endpoint backup tools protect computers, not cloud mailboxes and drives — and Microsoft’s own services agreement recommends customers regularly back up content stored in its services using third-party tools. Cloud-to-cloud products like Afi and Backupify, or the M365 add-ons from IDrive and CrashPlan, cover that layer.
What is the 3-2-1 rule?
Keep three copies of your data, on two different types of storage, with one copy offsite. Cloud backup covers the offsite copy. And test your restores periodically — a backup that has never been restored is unverified.
Related Articles
- Best Insurance Agency Management Systems for Life and Health Insurance Agencies
- Best Insurance Agency Management Systems for Property and Casualty Agencies
- Best E-Signature Platforms for Insurance Agencies
Sources
- NextAgency: Cloud Backup Software for Life and Health Insurance Agencies, https://nextagency.com/cloud-backup-for-insurance-agencies/, retrieved July 2026.
- HHS: HIPAA Security Rule, https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html, retrieved July 2026.
- HHS: Business Associate Contracts, https://www.hhs.gov/hipaa/for-professionals/covered-entities/sample-business-associate-agreement-provisions/index.html, retrieved July 2026.
- Microsoft Services Agreement, https://www.microsoft.com/en-us/servicesagreement, retrieved July 2026.
- Backblaze Pricing, https://www.backblaze.com/cloud-backup/pricing, retrieved July 2026.
- Backblaze and HIPAA, https://help.backblaze.com/hc/en-us/articles/217667238-Backblaze-and-HIPAA, retrieved July 2026.
- Backblaze Extended Version History, https://www.backblaze.com/cloud-backup/features/extended-version-history, retrieved July 2026.
- IDrive Pricing, https://www.idrive.com/pricing, retrieved July 2026.
- IDrive Compliance, https://www.idrive.com/online-backup-compliance, retrieved July 2026.
- Capterra: IDrive, https://www.capterra.com/p/171884/IDrive/, retrieved July 2026.
- Carbonite Safe Buy Page, https://www.carbonite.com/backup-software/buy-carbonite-safe/, retrieved July 2026.
- Carbonite HIPAA Support, https://support.carbonite.com/articles/Appliance-Pro-Server-HIPAA, retrieved July 2026.
- Acronis True Image Purchasing, https://www.acronis.com/en/products/true-image/purchasing/, retrieved July 2026.
- CrashPlan SMB Pricing, https://smb.crashplan.com/smb-pricing/, retrieved July 2026.
- CrashPlan and HIPAA, https://support.crashplan.com/hc/en-us/articles/9648622256909-CrashPlan-and-HIPAA, retrieved July 2026.
- Capterra: CrashPlan, https://www.capterra.com/p/145112/CrashPlan/reviews/, retrieved July 2026.
- Dropbox Backup, https://www.dropbox.com/backup, retrieved July 2026.
- Dropbox HIPAA/HITECH Overview, https://help.dropbox.com/security/hipaa-hitech-overview, retrieved July 2026.
- Afi Pricing, https://afi.ai/pricing, retrieved July 2026.
- Afi Compliance, https://afi.ai/compliance, retrieved July 2026.
- Backupify, https://www.backupify.com/, retrieved July 2026.