RPO, RTO, incremental, WORM, versioning — backup vocabulary gets thrown around constantly in vendor conversations, comparison articles, and support docs. Here’s a plain-English glossary of the 20 terms you’ll actually run into, with no jargon left unexplained.
Talk to a backup vendor for ten minutes and you’ll hear at least five terms that nobody bothers to define. RPO. Immutable. Zero-knowledge. WORM. Most explanations either assume you already know the vocabulary, or bury the definition in a wall of marketing language that doesn’t actually answer the question.
This glossary fixes that. It’s split into two halves: 10 terms everyone evaluating backup should know, and 10 terms that matter more once compliance, IT, or enterprise buying comes into the picture. Read through once, and you’ll be able to walk into any vendor conversation — or any of our own articles — already speaking the language.
20
Terms covered, each with a plain definition and a real example
2
Sections: everyday fundamentals, and compliance/enterprise vocabulary
5 min
To read the whole thing and never be confused by a vendor call again
10 fundamentals everyone should know
These are the terms that come up regardless of which backup provider you’re evaluating, or whether you’re backing up a personal laptop or a company’s entire infrastructure.
01
RPO
Recovery Point Objective — how much data you could lose, measured in time. If your RPO is 24 hours, the worst case is losing a day’s work.
In practice: “Our RPO is 4 hours” means: if something goes wrong right now, at most you’d lose the last 4 hours of changes.
02
RTO
Recovery Time Objective — how long you’d realistically be down before you’re fully back to normal after data loss.
In practice: “Our RTO is 2 hours” means: from the moment of failure, you should be back up and running within 2 hours.
03
Full Backup
A complete copy of everything in scope, taken all at once. Simple to restore from, but slow and storage-heavy to run repeatedly.
In practice: Most tools run one full backup initially, then switch to incremental for everything after.
04
Incremental Backup
Only backs up what changed since the last backup — full or incremental. Fast and storage-efficient, which is why most modern tools default to it.
In practice: If you edited 3 files today, an incremental backup only touches those 3 files, not your entire library.
05
Differential Backup
Backs up everything that’s changed since the last FULL backup — not since the last backup of any kind. A middle ground between full and incremental.
In practice: Restoring from a differential backup needs only the last full backup plus one differential — simpler than piecing together many incrementals.
06
Versioning
Keeping multiple historical copies of a file over time, so you can go back to last Tuesday’s version, not just yesterday’s.
In practice: Version history is what lets you undo a bad overwrite from three weeks ago, not just recover a deleted file.
07
Retention Policy
The rule that decides how long old backup versions are kept before being permanently deleted.
In practice: A 90-day retention policy means you can go back up to 90 days, but nothing further.
08
Snapshot
A point-in-time capture of a system or dataset’s exact state, often used for fast rollback.
In practice: Taking a snapshot before a risky software update lets you roll back instantly if something breaks.
09
Immutable / WORM
Write Once, Read Many — backup storage that can’t be altered or deleted once written, even by an attacker with admin access.
In practice: Immutable backups are what stop ransomware from being able to encrypt or delete your safety net.
10
Deduplication
Identifying and storing only one copy of identical data that appears multiple times, saving significant storage space.
In practice: If ten people back up the same company template file, dedup stores it once instead of ten times.
💡 The one distinction that trips people up most
RPO and RTO get confused constantly. RPO is about how much you could lose. RTO is about how long you’d be down. They’re both time-based, but they measure completely different things — and a vendor’s marketing page rarely spells out which one they’re actually promising.
10 terms that matter for compliance and enterprise buyers
Once backup decisions involve a compliance team, an audit, or a legal requirement like GDPR or HIPAA, this second set of vocabulary starts showing up constantly.
11
Zero-Knowledge Encryption
Your files are encrypted before they ever leave your device, so even the backup provider technically can’t read them.
In practice: Ask any vendor directly: “is encryption applied before or after data reaches your servers?” — that’s the zero-knowledge question.
12
Encryption at Rest
Data is encrypted while it’s sitting in storage, not just while it’s traveling over the network.
In practice: Encryption in transit protects data on the way there. Encryption at rest protects it once it has arrived.
13
SLA
Service Level Agreement — a vendor’s contractual promise about uptime, response time, or performance, with defined consequences if they don’t deliver.
In practice: A “99.9% uptime SLA” typically comes with service credits if the provider falls short of that number.
14
Uptime
The percentage of time a service is actually available and working, usually expressed as a number like 99.9%.
In practice: 99.9% uptime still allows for about 8.7 hours of downtime per year — worth knowing before you assume “99.9%” means “never down.”
15
Failover
Automatically switching to a backup system when the primary one fails, ideally without anyone noticing.
In practice: A well-configured failover means a server outage becomes a non-event instead of a crisis.
16
Air-Gapped
A backup copy that’s physically or logically isolated from the network, so malware or an attacker can’t reach it directly.
In practice: An air-gapped copy is what survives even when an attacker has full access to your live network.
17
Data Residency
Where your data is physically stored — which matters significantly for regulations like GDPR.
In practice: A business handling EU customer data may be required to confirm their backups stay within EU-region storage.
18
SOC 2
An independent audit confirming a company’s security controls meet a recognized standard.
In practice: “
SOC 2 Type II certified” is common shorthand for “we take security seriously and have the audit to prove it.”
19
Right to Erasure
A person’s legal right, under GDPR and similar laws, to have their data deleted — including from backups.
In practice: This is why backup retention policy and deletion capability both matter for compliance, not just security.
20
Sub-Processor
Any third party your vendor uses to help deliver their service — worth knowing about for compliance, since your data may pass through them too.
In practice: If your backup vendor uses a separate cloud storage provider under the hood, that provider is a sub-processor.
✅ Want this as a printable reference?
We’ve turned this glossary into a one-page printable card covering all 20 terms — useful to keep next to your desk during vendor evaluations or audits.
None of these 20 terms are complicated once you see them defined plainly — the difficulty was never the concepts themselves, just the fact that almost nobody bothers to explain them clearly. Bookmark this page; it’s worth coming back to the next time a vendor call throws an unfamiliar term at you.
