Why don't you keep a drive per customer (in a bank if needs be) and upload it to Glacier for redundancy? Couple it with making a copy of the drive when you drop

Why don't you keep a drive per customer (in a bank if needs be) and upload it to Glacier for redundancy? Couple it with making a copy of the drive when you drop it in a mail for a customer, and you have two levels of recovery at any given moment, one - instant, another - from Glacier.