I, as several of the other respondents do, also scan documents onto files which are then stored on thumb drives, along with all the rest of my files. (I keep almost nothing but the OS and programs on the internal hard disk)
Once a week I back up my working thumb drive to an encrypted local file which is stored on the internal hard disk as well as copied to yet another thumb drive which is locked away.
Being a highly suspicious type, as well as a former IT person trained back in the 70's by NSA, I NEVER use the cloud, even though it's convenient, because that puts the integrity and safety of my data out of my control and everybody knows that eventually someone is going to screw up. I also use an off-the-shelf encrypting security app on each of my thumb drives. that way if someone gets their hands on one of my drives they also have to crack my 32 character password before getting at the files. (For an extra layer of security, sensitive files are also individually encrypted with their own unique password.)
Because I keep the thumb drives separate from the computer unless I'm actually working with one, if someone walks off with the latter they won't have the former and all I have to do to get up and running again is find another computer to plug my thumb drive into.
