Re: Customer caught
Rsync replication won't help. It will sync the encrypted files and delete the originals!
We had a CEO who decided mirrored, redundant servers were the solution, hot stand-by, so no need for backups. Until he managed to corrupt the database and realised the hot stand-by also now had the corrupted database as well.
Offsite, offline backup on a separate medium is the only real answer. And offsite != cloud backup. Tapes on another site in a fire safe or in a bank valut, for example, are proper offsite backups. Cloud backup, unless you use glazier style is online and disk based, which breaks 2 two rule in 3-2-1 backup (no file exists, until there are at least 3 copies, on 2 different medium and 1 is offsite). Although a backup on an HDD array half way around the world is probably OK these days.
I use replication to an external drive, replication to a NAS and cloud backup at home. At work we have Veeam onto hot near-line storage and onto external media, into the fire safe.