How we build independent copies
Two locations, separate keys and regular restore drills.
"Backed up" is a vague thing to put on a status page. A copy that lives in the same room, on the same key, and has never been restored is a hope. The desk keeps two copies of an archive, in two places, and the check we publish is whether a file put in on a given day can be read back from the copy that is not the one you usually see.
Two places, on purpose
The working copy is the one the desktop talks to. The second copy is written on a delay, to a different location, with its own key. A mistake that deletes or encrypts the working copy does not get to rewrite the second copy in the same minute. That delay is the point. It is long enough for a person to notice a bad run, and short enough that the second copy is not a museum of last season.
The locations are independent in the ordinary sense: separate power, separate administration, separate credentials. We do not describe them as a city on the marketing page and then keep both disks on one shelf. The status line you can see on the desk names the copy and the time it was last read back, not a slogan.
What a drill looks like
On a schedule, an unattended job picks a file that was added by a real workspace, reads it from the second copy, and compares it with the record taken when it was stored. The job records the count of files checked, the time, and any mismatch. A mismatch is an incident, not a graph that dips and recovers without a sentence attached.
Owners can run the same kind of check themselves on a folder they choose. That is the rehearsal described in the archive owner guide: restore to a side location, compare the count, read the names. The internal drill does not replace that. It answers a different question, which is whether the copy we hold for you is the copy we claim to hold.
Keys and the people who hold them
The key for the second copy is not on the machines that serve the working copy. Access to it is a named action, written down, and not part of an ordinary deploy. We would rather a restore take a few extra minutes than have a single password that opens both. This is also why a support conversation cannot "just pull the file from the other side" without the owner's own restore. The other side is not a convenience shelf.
What this does not mean
It does not mean a file can never be lost. A file that was never uploaded is not in either copy. A folder an owner deleted, and whose retention window has passed, is gone from both on purpose. Independent copies protect the archive you asked us to keep. They are not a private history that outlives your own retention rule.
The current plans include both copies. There is no longer a cheaper plan with one copy and a footnote, because that was the arrangement people misunderstood. If you want the status of the last drill for your own workspace rather than the service as a whole, it is on the service status page and in the activity history of the workspace.