BackupReview.info Interviews Robert Gerace, CEO, CRC Data Protection Online Backup

This is an exclusive interview conducted by Backup Review (here on referred as “BR”) with Robert Gerace (here on referred as “RG”), CEO of CRC Data Protection.

We are now headquartered in our 32,000 square foot building just north of Atlanta, GA. We maintain a sales office in Palm Coast, Florida – and another in Mooresville, North Carolina. Our clients are in the US, Canada, and US territories.

BR: How many employees do you have and how big is your R&D department? What are your best selling products and services and why are they selling so well?
RG: CRC has 44 employees with 4 in R&D. Since we sell Asigra Televaulting as a service, Asigra handles keeping our products and services up to date – and they do a great job of it. In fact, we had a version able to back up the 64 bit Microsoft Exchange 2007, the day we needed it.

We focus on helping midsized (and larger) companies to round out their disaster recovery plans with very high-end features (such as bare metal restore, hot database backup, and message level restore.) While Asigra absolutely supports those operations, and while it is easy for a company to say it supports them, making the technology work requires a very highly skilled team. For a company to truly deliver these services it needs MCSE level technicians who understand the Microsoft Server operating systems and applications (Exchange, SQL, SharePoint) – as well as Active Directory. So, our best selling service is CRC DataProtection’s only service: helping companies with complex environments to understand what must be done while the network is intact so that all of these great-sounding features will actually work when necessary, ensuring that the solution continues to function as designed, — and then our real strength – getting in there and making the technology pay off when the chips are down.

It sells so well because few companies actually have the technical expertise to really drive the value from this top-end software – as well as the business expertise to communicate with executives. It’s important to learn what systems are business critical – and then tie the whole package together in such a way that the client receives maximum protection with minimum waste.

BR: What makes your company and its services different from others?
RG: CRC is made up of three business units: our Software as a Service, our IT Managed Services, and our Data Protection Services. These three units create a synergy that is unmatched in the industry. Here’s why:

Our SaaS unit provides payroll and invoicing, as well as project execution data for over 108,000 end users. Those systems must always be available. Growing and developing that business taught us much about what it means to host a secure site with high bandwidth – as well as what it means to be always available. This business unit caused CRC to invest in infrastructure that never goes down: premium data center collocation (x2) as well as our own fiber-fed data center (a third site). We employ the latest CISCO security appliances (both firewalls and Intrusion detection) as well as multiple software security and monitoring tools. We own and staff our own NOC.

Our IT Managed Services division forces us to support a wide range of networks – all of which desperately need backup. We also have a wide range of IT companies in markets across the country, which are VARS and resellers for us. We understand their business better than most of our competitors because we actually run a business like theirs. We have to maintain our certifications, and we are in the thick of evaluating new technologies, making recommendations to clients, keeping a wide range of network systems running. We inherit the poorly designed systems of new clients, and they need an immediate backup solution, which we are happy to supply. This direct experience in the field every day gives us a huge advantage over companies that only sell backup solutions. The main thing that differentiates us from other Asigra service providers is the fact that our MCSE’s and MCDBA’s are experts in Microsoft Exchange, Active Directory, SQL Server, and SharePoint. We install, troubleshoot, and maintain these systems. We maintain a laboratory environment to actually backup and restore those servers, to the bare metal. We are confident that we can actually restore these servers – even to different hardware and virtual machines.

Another way we differentiate ourselves is in the area of VMware. Using VMware, we can virtualize servers for our clients, and make them very, very resilient. After a server has been virtualized, it can be moved while running. Our Asigra technology allows us to back up the virtual system and restore it anywhere. So, our bare metal backup combined with virtualized servers means that we can offer our clients a hot-site and guarantee that we can meet their Recovery Time objectives. By combining this with Asigra’s Continuous Data Protection, we can guarantee to meet their Recovery Point Objectives. The ground breaking thing about this philosophy is not just these technologies – as other companies have been doing similar things for years. Rather, the ground breaking thing about this is the fact that we are doing it for many of our clients for $1,000 to $3,000 per month.

Finally, our CRC DataProtection division (built on the foundation of the two business units above) is something that those two business units rely on. We back up 2TB of our own data (much of which is client data). This strong statement says that we bet our entire business on being able to back up (and restore) our own systems using our own technology. We have every bit as much at stake in CRC DataProtection as we ask our clients to put at stake.

To that end, when we built CRC DataProtection, even though our advisors told us to start small, go with a standalone system, and low-cost back end storage, we refused. We insisted on the high end, high availability, N+1 configuration backed by redundant, replicating, geographically separated EMC NAS storage. We don’t want to lose our own data any more than our clients want to lose theirs; and there is a right way to do it and a wrong way to do it. We did it right.

Finally, CRC has been profitable (with the exception of an accounting charge off in 2002) since 1998. While it took a while for us to start earning enough money to pay for all of the redundancy above, the division was never under any pressure from any VC, Angel, or any other type of investors to do anything – because there are none. CRC is a closely held, profitable corporation that can afford to do it right, and we do.

BR: One of the biggest concerns of online backup users is data security and privacy. How have you addressed these issues?
RG: The Asigra Televaulting service that we use provides for AES 256 bit encryption at the client site. The encrypted data is sent over the Internet and stored on our vaults as encrypted. Only the client knows the keys to decrypt the data (unless they choose to share them with us). During a restore, the encrypted data is sent back to the client, where the program decrypts the data after successful entry of the keys. If the keys are lost, the data can never be recovered.

Our vaults are not on the same physical network as our other Internet facing servers, and have only one, non-standard port open – and it only answers to our software clients. All of our networks are protected by CISCO state-of-the-art ASA security appliances and monitored for intrusion. Our primary and secondary data centers are Premium co-location facilities with all the name implies (the concrete walls, biometric, monitored access, redundant power and cooling, etc.) Our tertiary data center (in our own building) also has card-key access, recorded cameras, and security on site.

BR: What kind of growth rate have you been experiencing? And what is your expected growth rate for the next few years?
RG: CRC DataProtection is seeing exponential growth. We expect that to continue for quite some time.

BR: How has online backup business evolved in the last few years, and how do you see it further evolving?
RG: Just as there is an automobile for almost every type of driver, there is quickly becoming an online backup service for every type of user. At the low cost, easy to use end, there are new providers (almost daily) entering the market with the promise of a mouse click and a few dollars and unlimited backup. At the high end, are companies like CRC DataProtection – companies that must truly understand the corporate culture, network topographies, non-stop server applications, and how to back up and restore those environments. In between are many companies offering more or less features or higher or lower cost – and some saying they are both – and pulling off neither low cost, nor business critical data protection and disaster recovery.

What’s next? I believe further specialization.

BR: Whom do you consider your main competitors?
RG: Tape. There are so many potential clients out there that we rarely run up against EVault, LiveVault, and AmeriVault – all three we believe are on par with CRC DataProtection.

No, the real competitor out there is tape. Perceptions are changing, and people are waking up to understand that they would never think of storing their downloaded music on tape…but there sure is a ton of it out there in Corporate America – and quite a bit invested in robots, silos, drives, and media.

Talk to the IT staff in most companies and they understand – as long as they can have local restore and portable data delivery…but when they try to sell it to their management it is often a hard sell. That is our challenge – educating CEO’s and CFO’s that Enterprise Online Backup can actually pay for itself – and not b another 4 digit monthly expense.

And it does pay for itself. Very little IT time will be spent in remote offices, or monitoring tape drives that are forever jamming…most restores are immediate as opposed to taking hours (or days), and there is no further need to replace media and drives as data grows (and drives and media wear out).

BR: Large companies such as Microsoft and major telco’s have started offering online backup business. Do you fear them? How do you plan to compete against such formidable adversaries?
RG: Microsoft has a huge network of IT partners to get in to the trenches with the SMBs out there. Clearly they understand that to serve end users well, the provider must understand the day-to-day needs of the user. Microsoft relies on its Partner Network to leverage local and vertical market knowledge to add value to its services. In my opinion, data protection requires the same level of client-specific knowledge. In addition, bringing these servers back on line requires an even higher level of expertise than the Microsoft Partner Program currently provides to the SMB market. So, no, Microsoft doesn’t worry me.

BR: There has been quite a bit of M&A activity in the industry lately (such as xdrive being acquired by AOL, Microsoft acquiring Foldershare and LiveVault by Iron Mountain, and Evault by Seagate). What is your strategy? (being acquired, IPO, etc…)
RG: It’s never been our intention to take our company public – or to sell it to a private buyer for that matter. However, we are actively seeking small online backup companies that are for sale, and buying them is one of our planned growth strategies. 10. Are there any new products/services you are developing that will soon be available?

We just announced the ability to back up Microsoft Sharepoint as one solution. Many companies have been attempting to back up the separate parts, but Asigra is one of the few (if any) companies that has pulled it off.

We’ve also announced support for 64 bit Microsoft Exchange 2007. Asigra’s roadmap is confidential, but I can tell you that if SMB’s are running state-of-theart services, we will absolutely be able to back them up – with all of Asigra’s award winning features.

BR: What is your opinion about Google entering the online backup business?
RG: I have similar feelings to my comments about Microsoft. Google is too big to get down in the trenches, roll up their sleeves, and help somebody get a clean, bare metal backup – and then test it with them – so that everybody knows it will restore when the time comes – and too big to understand the day-to-day challenges that a 15 physician medical office (or a 30 attorney law firm) or a 100 employee government contractor with offices in three states really needs.

BR: Do you feel that Google will dominate the market?
RG: No. I do think they will have many people storing data on their servers, but I do not think that they are a focused data protection company.

BR: What is your annual revenue?
RG: As a private company, we do not disclose those numbers.

BR: How does your proprietary technology compare to the proprietary technology of main competitors?
RG: CRC DataProtection, like other Asigra Televaulting Service Providers, uses agentless technology. Due to the agentless nature of our software, only one computer (typically the ‘backup appliance’) is used to run all the backups on an average sized LAN. The advantages of this technology are many: servers are free of performance-degrading software that creates more variables to consider during troubleshooting; there is a single management point; it’s easier to deploy; and there is no chance that the backup software will conflict with server applications and cause outages. In addition, our software backs up just about anything business critical: Windows, Solaris, Linux, NetWare, VMware, MAC, databases, email messages, operating system server states, and much more. It does so with proprietary common file elimination (also known as de-duplication) – which saves time, money, and bandwidth because it does not back up what it already has a copy of. Smart delta-blocking technology ensures that only a very small part of a large file is backed up if a backed-up file changes by a small amount – with the same benefits.

The ability to restore from the local backup appliance, and do the initial backup (and emergency restores) from a USB drive also helps companies to better manage their data.

The ability to segregate data as the data ages is a huge advantage of our service. Data that is critical to the day-to-day operation of the business can be restored immediately, online – and carries a premium price to protect. However, data that a company can afford to wait 24 hours to get costs less…and our software can move the data as it ages…automatically. Data that is only being backed up for archival purposes can be moved to CD, DVD, or USB drive.

Finally, when a company’s data grows to size that where it no longer makes sense to pay a service provider, we can act as a reseller for Asigra, sell our client their own vault – and either host it for them, or provide consulting for them to host it themselves.

BR: What is the most regrettable mistake that you or your company made in the past? How would you handle that mistake if you got a second chance? In the future, say five years from now, do you think the cost of online backup will remain as today or will it go significantly cheaper (For example to backup a 1 GB file)?
RG: Not starting sooner. In 1989, in the very early days of our company, we discussed the idea of backing up data over the Internet (or even connecting over the Public Switched Telephone Network via modem) as a possible business. Had we put everything we had into that idea (which we tabled for years after that) – we would be much larger today.

I think companies like Google will offer storage for free, as will others looking for ways to build traffic to their sites. I believe that business specialists will always be able to charge a premium like any other profession, and for that reason I don’t see the service getting significantly cheaper. Storage is getting less expensive every day, but storage is growing every day. Bandwidth is getting cheaper as fast as demand for it is growing as well.

BR: How many subscribers do you have? What is the amount of file you backed up in your servers?
RG: This is another number that we keep private. However, we do state on our website that we protect the data of over 800 companies.

BR: What do you see as the greatest challenges facing your company today? And what are your biggest accomplishments so far?
RG: Because of our IT Managed Services division, we sometimes struggle to sign up resellers of our service in our Managed Services Market of Georgia, North Carolina, and Florida. Resellers are a key factor in much of the growth that is happening in the industry. Our challenge is to give IT companies a comfort level that we are not going to steal their customers.

CRC is still around after all these years due to one primary reason. We operate an ethical business and we do not engage in any transaction unless all parties involved feel like they received fair, honest, and ethical consideration for what they brought to the table.

I’d like to state here and now that for our current partners, and for those who will consider reselling our services to their clients, CRC will make no attempt to learn who your clients are, nor will we take business from any company that tries go around you to get to us.

Additionally, while it is not inexpensive, IT companies can have our version of the Asigra software branded with their own logo; so your clients don’t even need to know anything about us. We can also offer a non-branded version of Asigra for no additional charge; so clients of VARS can provide the service to their clients without their clients knowing anything about CRC.

Our biggest accomplishment is the good will we’ve earned from our clients by being there when they need us. We wake up every morning asking ourselves what can we do to strengthen our infrastructure and the delivery of our service, and each day we make incremental improvements in our processes and infrastructure. We achieved those goals long ago, but we continue to exceed the increasingly higher goals we set in those areas. The single most important thing to CRC is to continue to earn the trust of our client base every day. When they come to us, we must always be in a position to deliver. Our accomplishment is building a system that does.

BR: What are the key competing technologies and what are some of the advantages you offer over the competition?
RG: If your readers really take a hard look at many of the companies that are out there – and I’m speaking even of the very large ones – while they say that they back up your data to multiple data centers, and they speak about how solid their solution is…if you One of the reasons we chose Asigra to partner with for our backup software was due to a feature they have called Autonomic Healing. Autonomic Healing runs 24x7x365 on all of our vaults. It constantly looks for corrupted, partial, orphaned, missing, etc. type files. In a nutshell, it looks for anything wrong, and if it finds something wrong it fixes it – automatically. So we are extremely confident that anything that gets backed up can be restored – so long as the client has selected a long enough period to retain it of course.

Also, different from some services, if a file gets deleted on the source computer, it stays on the vault for as long as it has been set to be retained. Further, if it gets deleted from the vault, it stays on the vault for 30 days just to help catch accidental deletions. So our contract reads that we will back your data up to at least two data centers (with the caveat that if you dump a TB on our vault, you either need to pay for us to fly to the secondary vault or it will take a very long time before it replicates.) Our contract also states that if you have selected a file for backup, the backup ran successfully, and the backup set was set to retain the file – and you attempt to restore it and can not, we will refund 100% of everything you have ever paid us. Period. (We’ve never had to pay off on that guarantee, and I believe we never will.) That’s how sure we are that you data will be there when you need it.

BR: Can you tell us about your servers? Where they are located, how many backups you perform, if server room is controlled for humidity, etc?
RG: We have an N+1 grid of vaults, or as Asigra calls them, DS-Servers. For those who don’t know, N+1 means that one more than half of the total number of DS-Servers that are running can fail before the entire system fails.

Currently, we have three servers on that grid, which means two have to fail before the entire system is unusable. We can grow this system to many servers on that one grid, and our plans are to double the size of the grid each year. Due to the grid, our up time is 100% (not 99.999%, but 100%) almost every month, and never less than 99.999%. The servers have RAID-5 disk space of their own, but it is only used for the Linux operating system. The back end storage is EMC NS40 NAS – which replicates to an identical system in another collocation facility over 600 miles away.

All of this equipment is kept under 4 hour, onsite service in Premium Data Centers with hurricane resistant, tornado proof walls, cameras, barbed wire, biometrics for entry, redundant power, cooling, etc.

We keep a close eye on performance, bandwidth, and capacity, and we are able to scale quickly and easily because we have built the correct infrastructure to do so.

BR: Any other news about your company you care to share?
RG: Yes, we just installed a complete sales-lab in Atlanta that allows us to demo all of the features described here, and we welcome clients and potential clients to come and‘destroy’ a high-end server, only to see it come right back before their eyes.