Ask how often files and databases copy, where they live (off-server?), and retention length. Test a restore at least annually—surprises show up during restore, not backup.
Versioned backups help when malware injects files slowly; point-in-time databases help when a bad import wipes data.
Combine hosting backups with your own exports for critical applications—belt and suspenders for irreplaceable data.