I use borgmatic with a dedicated non-US backup service. Borg isn’t ideal, sometimes three locks get stuck, and it’s anything you can only mount it via FUSE, but it works reliably. I hear the more modern solutions are better, but I don’t want to deal with migrating.

Then I have secondary regular cloud file storage (non-US) that has a write only storage mechanism. I only write encrypted files there, so data is encrypted at rest and in transit.

On macOS I run a custom launch agent script to run borgmatuc hourly, on Linux I use nix+systemd.

I also have a NAS in my basement.