The app notices: when many files change all at once, or get suspicious extensions, it pauses uploading and warns you, so the encrypted files don’t replace the ones in the archive. The archive emails you and your administrators. And if something has already been uploaded, the previous versions stay in the archive: with Restore to a date you get your files back as they were before the attack. From the website you can also disconnect the affected computer. By default we keep the last 10 versions of each file, for up to 30 days (other values can be agreed in the Business and Public sector plans): the sooner you notice, the better.