I rely mostly on Borg backup¹.
1. First, I run it locally on my desktop against a repository I keep on the same drive (/home/backup); then
2. I update, with rsync, a copy of this repository I keep on a dedicated server with full disk encryption; and, finally,
3. I spin up an EC2 instance, mount an S3 bucket with s3ql, and rsync the copy from the previous step up to the one I keep on this bucket.
This process is (embarrassingly) manual.
The backup repository is encrypted with Borg itself, and if I am in need of recovering something I do it from the local copy. I never mount the repository in remote locations.