Laximum Security

I'm under the belief that backups should be done nightly and, possibly every few days, an archive should be sent offsite to a safe or safety deposit box. That's the way it has worked at my last two jobs, one a dot-com, the other a non-profit. Here they do backups nightly and my boss takes the tapes home with him every evening. Am I wrong to find this unsettling? I've approached the topic twice and both times the boss has reacted defensively. I don't plan to back down but this is a problem.

I understand his concern. If nightly tapes are left near the servers and a catastrophic event occurs we lose a few days worth of data. My concern is that with tapes constantly traveling with him there is much greater risk of data on our donors, and everyone we help, getting into the hands of identity thieves. I'd rather lose a couple of days data to a catastrophe than a lifetime's work to identity thieves. I'm sure everyone that helps us would prefer it that way too.

Suggestions? Opinons?