Your data is isolated per company: every record carries its workspace identity, and requests for another workspace are refused rather than filtered — so one customer's data cannot appear in another's reports.
Access is controlled by role-based permissions, optional two-factor authentication, and login throttling that blocks repeated failed attempts. Every important action is recorded in the audit log.
Backups can be taken on demand from the Backup page, and scheduled so they happen without anyone remembering. A backup is a complete database dump — restoring it returns the workspace to exactly that moment.
Two things remain your responsibility, and they are the two that actually cause data loss in practice: download a copy of your backup somewhere outside the server from time to time, and remove access promptly when someone leaves. No system can do either of those for you.