Dropbox Keeps Files Moving.
It Is Not a Backup.

What Dropbox actually does well

Dropbox is genuinely useful, and it is worth saying so plainly before getting into where it falls short. This page is not an argument against using Dropbox.

Dropbox is one of the original cloud file sync and sharing services, and small businesses and creative teams use it to keep documents, design files, contracts, and project folders in step across every computer and phone signed into the account. Shared links and shared folders make it simple to hand a client a set of deliverables, collect files from a contractor, or keep a whole team working from the same current set of documents without emailing attachments back and forth. Dropbox Paper and in-app commenting let people give feedback and collaborate directly on files rather than trading versions by email.

The Dropbox desktop app can run in a mode, presented in the app as choosing files and folders to keep local versus online only, that lets a laptop with limited storage show every file in the account while only actually downloading the ones someone opens. That selective sync approach is convenient for people who work across multiple devices with different amounts of storage.

Dropbox also keeps version history for files stored in it, and a feature usually called Rewind lets you roll an entire folder or account back to an earlier point in time, which can undo a batch of unwanted changes or accidental deletions. Deleted files pass through a recoverable state for a period before they are gone for good. Business and Team plans add admin console controls, team folders, and device management, giving an administrator visibility across a company's account that an individual account does not have on its own. Dropbox also offers a computer backup feature, available across most of its individual and business plans, that can keep specific folders on a computer, such as Desktop, Documents, and Downloads, continuously mirrored into Dropbox.

All of that makes Dropbox a strong tool for staying in sync and collaborating on shared files. None of it, on its own, makes Dropbox a backup, and the reasons are specific enough that they deserve to be spelled out rather than assumed.

Why Dropbox alone is not a backup

A backup exists to give you a copy of your data from before something went wrong, held somewhere a single account compromise, sync error, or local disaster cannot reach at the same time. Dropbox, by design, does not create that kind of copy. Here is each gap in detail.

• Sync propagates deletions and ransomware encryption to every linked device and to the cloud. The Dropbox desktop app is built to keep the local Dropbox folder on every linked computer and the copy in the cloud showing the same current contents. That is what makes sync useful, and it is also why a deletion made on one device syncs everywhere else, and why files encrypted by ransomware on one machine sync their encrypted versions up to Dropbox and back out to every other linked device, often before anyone notices anything is wrong. CISA's #StopRansomware guidance calls for keeping at least one backup copy that is offline or air-gapped, not reachable from the running operating system, precisely because anything continuously connected and syncing can be reached by the same event that damages your primary files.
• Version history and deleted-file retention are finite, and they vary by plan. Dropbox retains prior versions of files and gives you a window to recover deleted items, and Rewind extends that to whole folders or accounts. How far back that window reaches is not the same for every account. It differs by plan and tier, and Dropbox also sells a separate Extended Version History add-on for businesses that want a longer window than their base plan includes. Those specifics change over time, so rather than quoting a number of days here, the practical point is to check current Dropbox documentation for the retention window that actually applies to your account and plan, and to treat whatever that window turns out to be as a short-term safety net for recent mistakes rather than a long-term archive.
• The local Dropbox folder, including files marked local or online only, is a mirror, not a second copy. Whether a file is kept fully local on a device or set to online only through Dropbox's selective sync controls, it is still one side of a continuously synced relationship with the cloud copy, not an independent copy sitting apart from it. Online only files are not even stored on the device until opened; they exist as placeholders pointing at the same single cloud copy every other synced device is also pointing at. If that cloud copy is deleted, overwritten, or encrypted, every device syncing against it reflects that change. Two locations kept identical to each other by ongoing sync are functionally one copy, not two, no matter how the interface presents them.
• An account lockout, or a departing team member's account, can take shared folders with it. Files and folders in Dropbox are tied to accounts, and shared folders depend on the membership and permissions attached to those accounts. When a team member's account is locked out, suspended, compromised, or simply deactivated after they leave the company, whatever they owned or controlled inside Dropbox can become genuinely hard to reach, sometimes requiring a Business or Team admin to step in through the admin console before anyone else can get to it. Knowing in advance who administers the account, and how ownership transfers when someone leaves, is worth settling before it becomes an urgent problem.
• Shared folder membership means someone else's delete can remove your only copy. A Dropbox shared folder is a genuinely useful way to collaborate, but by default every member of that shared folder can delete or move files inside it, and that action syncs out to every other member's copy of the folder, including yours. If the only place your business keeps a set of client files, project deliverables, or shared records is inside a folder shared with a client, contractor, or partner team, a mistake or a deliberate action by any one of those other people can remove the file from your view too, not just theirs. Rewind and version history may offer a path back within their retention window, but the underlying structure, a folder whose contents everyone with access can change or delete, is not one you control alone. If a shared Dropbox folder is the only place a file lives, it is not really under your exclusive control, and it is not a backup of anything.
• Files that live outside the Dropbox folder are never covered by Dropbox at all. Dropbox only protects what is actually inside it. In practice, a lot of a small business's most important data lives outside any synced Dropbox folder: QuickBooks company files and their supporting data folders, line-of-business application data stored locally, a Desktop or Documents folder that was never pointed at Dropbox, files sitting on an on-premises server share, scanned paper documents saved to a local folder, and machine-local databases used by point-of-sale, accounting, or scheduling software. None of that is touched by Dropbox's sync, version history, or Rewind, because Dropbox never sees it in the first place. A business that believes "everything is in Dropbox" without having actually verified which folders sync and which do not is often protecting a smaller slice of its real data than it assumes.

The pattern across all of these gaps is the same one that shows up with any cloud sync or collaboration platform: Dropbox is built to keep one current, consistent state of your files available everywhere, instantly, for everyone with access. A backup needs the opposite property in at least one place, a copy that does not automatically follow every change, held somewhere an account problem, a sync event, a shared folder member's mistake, or a local disaster cannot reach at the same time as your primary data.

What a complete plan looks like

Adding proper backup alongside Dropbox does not mean replacing it. Dropbox keeps doing what it does well, giving your team fast, shared, collaborative access to files. Backup fills the specific gaps outlined above. The first two criteria below come directly from CISA's 3-2-1 guidance and #StopRansomware recommendations. The rest are practical operating habits we consider sensible, not requirements drawn from those documents.

• Apply the 3-2-1 rule. Keep at least three copies of your data, on at least two different types of media, with at least one copy held off-site. Dropbox can reasonably serve as one of your working copies, but a synced cloud folder, on its own, does not satisfy the requirement for an independent second copy plus a separate off-site copy.
• Maintain at least one copy that is not reachable from the network. CISA's #StopRansomware guidance calls for at least one backup that is offline or air-gapped, not accessible from the operating system or network during normal operation. A synced Dropbox folder, and any shared folder attached to it, is exactly the kind of continuously-reachable storage this guidance is warning about. A separate, encrypted, off-site backup that is not part of your everyday sync or sharing relationships satisfies this in a way Dropbox alone cannot.
• Keep meaningful version history in a location off the account and off any shared folder. Ransomware, an account problem, or a shared folder member's mistake are frequently not discovered right away, so the useful question is whether your backup can still reach a point in time before the damage started. Version history held somewhere outside your Dropbox account and outside any folder shared with other people or organizations gives you that recovery point, independent of how long Dropbox's own version history or Rewind happen to retain at any given time on any given plan. Decide how far back you would need to go for your own business, then confirm your backup actually retains that far.
• Schedule backups automatically. A backup that depends on someone remembering to run it will eventually be missed. Set the schedule once and let it run without manual intervention.
• Enable failure alerts. You should not have to log in periodically to confirm a backup completed. A backup solution should notify you if a scheduled job fails or if too much time passes without a successful backup, so a gap in coverage does not go unnoticed until you need to recover.
• Test a restore on a regular basis. A backup that has never been tested is an assumption. Restore at least one folder or dataset from your off-site backup periodically to confirm the data is intact and that you understand the recovery process before you are under pressure to use it. CISA's guidance is that backups should be tested regularly. How often is a judgment call for your business, but a restore you have never performed is not yet a proven recovery path.

If your business relies on Microsoft 365 or OneDrive alongside or instead of Dropbox, the OneDrive is not a backup page covers the equivalent gaps on that platform, and the Google Drive is not a backup page does the same for Google Workspace and Shared Drives. For a broader explanation of why sync tools in general, including the Dropbox desktop app, are not a substitute for backup, see cloud sync vs. backup. If you are evaluating how ready you are for a ransomware event specifically, the ransomware restore readiness guide walks through the questions worth asking before an incident occurs. For a full checklist covering backup requirements for small businesses, see the small-business backup checklist.