an external drive and a secondary computer that's never going to be connected to the internet. Any file that would be open would be from your external drive first and using a virtual pc first before being save to a redundant drives. This is on top of encrypting your drives. Also have a few redundant drives in other places. If you are talking about highly sensitive files that you don't want to spread, never use cloud storage.