Choosing a storage VPS: a buying checklist

Choosing a storage VPS: the short answer

A storage VPS is bought for capacity, so most of what goes wrong with one is written in the offer rather than in the software. What makes a storage VPS different from a regular VPS is a separate question, and this checklist assumes you have already answered it. Before you click order on an offer (in German, an Angebot), settle five things: the disk class behind the capacity, the real traffic policy, what snapshots cost you, whether you get root, and the contract term. Work out the price per terabyte last, because that number only means something once the other five are known.

Most checks below come with a command you can run after delivery to prove the answer, usually while the money back window is still open. A pre-sales answer that your own machine contradicts is not the answer that counts.

Is the capacity on HDD or on SSD?

Capacity sold by the terabyte usually sits on hard disks (HDD, hard disk drive). Capacity sold by the gigabyte usually sits on SSD or on NVMe (non-volatile memory express). Plenty of offers say only "Speicherplatz: 4 TB" and leave the class out, so ask, because the class decides what you can put there.

[
  {
    "disk": "7200 rpm HDD",
    "random_read_iops": 120,
    "sequential_read_mb_s": 200
  },
  {
    "disk": "SATA SSD",
    "random_read_iops": "80,000",
    "sequential_read_mb_s": 550
  },
  {
    "disk": "NVMe SSD",
    "random_read_iops": "500,000",
    "sequential_read_mb_s": 3500
  }
]

A 7200 rpm hard disk is published at roughly 120 random 4k read IOPS (input/output operations per second), because the head has to move physically for every request that lands somewhere new. A SATA SSD is published at about 80,000 and an NVMe device at 500,000, since neither has a moving part. Those are datasheet numbers for a whole device. Your slice of a shared host will be lower, so read them as the shape of the difference and then measure your own.

The same hard disk still reads about 200 MB/s in one long stream, and that gap explains which workloads survive on it. A restic or borg repository writes large pack files in order, so it is happy on HDD. A PostgreSQL database, a busy container image store or a Nextcloud instance with many small files issues thousands of scattered small reads, so the same disk makes it crawl. If the plan is bulk backup, HDD is the correct buy. If it is a live application, work out how much storage you actually need first, then pair a storage VPS with your main VPS and leave the fast work on the fast disk.

Check the disk yourself in the first week

lsblk -d -o NAME,ROTA,SIZE,MODEL

ROTA reads 1 for a rotational device and 0 for a solid state one. Treat it as a hint rather than proof, because the flag belongs to the virtual disk the hypervisor presents, so a virtio device backed by NVMe can still report 1. Measure the disk instead.

sudo apt install -y fio
fio --name=randread --filename=/var/tmp/fio.test --size=2G --rw=randread \
  --bs=4k --iodepth=32 --ioengine=libaio --direct=1 --runtime=60 \
  --time_based --group_reporting
rm -f /var/tmp/fio.test

Read the IOPS= value in the output. Low hundreds means a hard disk. Tens of thousands or more means flash. --direct=1 is the part you must not drop, because without it the test reads from the page cache in RAM and reports a number the disk cannot produce. Run it twice at different hours, since a shared host at 03:00 is not the host you get at 20:00.

Is the Traffic really unlimited, or fair use?

"Traffic: unlimitiert" in an offer almost always means a fair use policy (Fair-Use-Policy) written into the terms (AGB, allgemeine Geschäftsbedingungen). Ask two questions and get the answers in the ticket: at what volume does the policy apply, and what happens when it does. Throttling to a slower rate (Drosselung), a charge per extra terabyte, and a request to move up a plan are very different outcomes hiding behind one word.

Read the port speed (Anbindung) as a separate number from the included volume. A 1 Gbit/s port with 20 TB included per month is a different product from a 1 Gbit/s port that drops to 10 Mbit/s after 5 TB, even though both offers print "1 Gbit/s".

Traffic on a backup target matters on one day: the day you restore. The box is quiet for months, then you pull everything back at once.

[
  {
    "label": "50 Mbit/s",
    "hours_to_move_1_tb": 44.4
  },
  {
    "label": "100 Mbit/s",
    "hours_to_move_1_tb": 22.2
  },
  {
    "label": "250 Mbit/s",
    "hours_to_move_1_tb": 8.9
  },
  {
    "label": "1 Gbit/s",
    "hours_to_move_1_tb": 2.2
  }
]

These rows are plain arithmetic: one terabyte is eight million megabits, divided by the rate. At 100 Mbit/s a single terabyte takes 22.2 hours at line rate, before protocol overhead, before the sending disk seeks, and before any throttle. A gigabit port moves the same terabyte in about 2.2 hours. Decide which of those numbers your work can survive, then buy the port and the policy that produce it. That is the arithmetic behind using a VPS as an offsite backup target.

Measure your own usage instead of arguing from memory, and prove the restore path at the same time:

sudo apt install -y vnstat
vnstat -m
restic -r sftp:backup@storage-host:/srv/restic check --read-data-subset=5%

vnstat prints received and transmitted volume per month per interface, which is the number to hold against the policy. It counts from the moment the service starts, so the first table is empty and only becomes useful after a full backup cycle has run. The restic check reads 5 percent of the repository back and verifies it, so it tells you the data is readable and shows you a real download rate.

Do snapshots and backups count against the quota?

Two questions hide inside the word snapshot. Does a snapshot consume the capacity you paid for, or does the provider keep it somewhere else? On a multi-terabyte plan the honest answer is often that snapshots are capped or absent, because copying 8 TB costs the host about as much as selling it. And where does the snapshot live? A snapshot held on the same host as the volume dies with that host, which makes it a rollback tool. The difference between snapshots and backups decides whether "inklusive Snapshots" in an offer is worth anything to you.

Ask for the retention as well: how many snapshots are kept, for how long, and whether creating one pauses I/O on the volume. If the storage VPS holds your only copy, it is not a backup, whatever the offer calls it. Keep a second restic repository on different hardware and the question of who owns the snapshot stops mattering.

Do you get root and SSH, or only SMB, NFS and rclone?

This is the line that separates a storage VPS from a storage box product (Storage Box, Speicherbox). A storage box hands you protocol endpoints: SMB/CIFS, NFS, SFTP, WebDAV, rclone. A storage VPS hands you a machine, with root, an SSH login, a console and the right to install what you like. The practical question is what can run on the far side of the link.

• Append-only backups. With root you can run restic's REST server on the storage side with rest-server --path /srv/restic --append-only. A client that gets compromised can then add snapshots but cannot delete old ones, because the server refuses the delete. An SFTP key that may write may usually also delete, so ransomware on your main server can erase the backup it just poisoned. This is the main reason a compromise on your main server does not have to take your history with it.
• Work that must run next to the data. Verification, pruning, replication onward to a second target and running a Proxmox Backup Server on a VPS all need a process on the storage machine. Over a plain SFTP endpoint, restic prune runs on the client and rewrites pack files across the network, so housekeeping spends your traffic budget.
• Recovery access. Ask whether the plan includes a rescue system (Rettungssystem) and a console, because a storage VPS you cannot boot is capacity you cannot reach.
• The operating system itself. Root means you patch it, so a storage VPS is an unmanaged machine unless the offer says otherwise, and managed and unmanaged VPS plans differ mainly in who answers at 02:00.

If your workflow only ever writes files over SFTP or rclone, a storage box is the cheaper answer and your checklist stops here. If anything has to run next to the data, buy the VPS.

What are the minimum term and the notice period?

Read four contract numbers: the minimum term (Mindestvertragslaufzeit), the notice period (Kündigungsfrist), the length of an automatic renewal (Verlängerung) and the setup fee (Einrichtungsgebühr). For consumer contracts concluded in Germany since 1 March 2022, the rules on automatic renewal are stricter than they were, and a renewed contract has to stay cancellable at short notice. Business purchases are treated differently, so a company can be held to the longer term it signed. Read the AGB, and take legal advice if the sum is large. None of this is legal advice.

The real cost of a long term on a storage plan is the exit, because leaving means moving the data out, and that is the same line rate arithmetic as a restore. A 12 month term on 8 TB is a commitment measured in days of transfer as well as in euros. Moving a server to a new VPS is an evening of work. Moving 8 TB is a week of waiting. Paying yearly for a discount is fine once the plan fits. While you are still guessing at the size, start smaller and ask whether capacity can be increased later without a reinstall.

How to work out euro per terabyte per month

Prices in this market moved from month to month through 2026, so a price table here would be out of date before you read it. The method is the durable part.

1. Take the monthly price you actually pay. Divide an annual price by 12.
2. Add tax if you cannot reclaim it. German business offers are usually quoted net (netto), and the standard VAT rate (Mehrwertsteuer) is 19 percent as of August 2026.
3. Spread the setup fee over the months you intend to stay. A 12 EUR fee across 12 months adds 1 EUR per month.
4. Convert advertised capacity into usable capacity.
5. Divide the monthly cost by the usable terabytes.

Step 4 is the one people skip. Advertised capacity is decimal, so 4 TB means 4,000,000,000,000 bytes, while df -h reports binary units and shows about 3.6T, which is 3.6 TiB (tebibytes). ext4 then reserves 5 percent of the filesystem for root by default, which is roughly another 180 GiB on that volume, paid for and unusable. Check both numbers on the live machine:

df -h /srv
sudo tune2fs -l /dev/vda1 | grep -i 'reserved block count'

On a volume that only holds data, no system process needs that emergency space, so lowering the reserve is safe and gives most of it back:

sudo tune2fs -m 1 /dev/vda1

A worked example with invented numbers: an offer of 4 TB at 12 EUR net per month, a 12 EUR setup fee, and a term of 12 months. The monthly cost is 12 plus 1, so 13 EUR. Usable capacity after the binary conversion and a 1 percent reserve is about 3.6 TiB. 13 divided by 3.6 gives 3.61 EUR per usable TiB per month. Run the same arithmetic on the competing offer, in the same unit, and only then compare the two.

Two costs sit outside that division. Traffic overage is one. The price of getting the data out again is the other, and that is where object storage stops looking cheap, because egress is billed per gigabyte: cheap terabytes on a storage VPS, block storage or object storage puts the options side by side. Compare against what you are replacing rather than against another VPS, since whether self-hosted storage beats Dropbox depends on how many seats you cancel. For the rest of the small print, reading a cheap VPS offer covers the tricks that are not specific to storage.

Where are the disks, and do you need an AVV?

If your backups contain personal data (personenbezogene Daten) about other people, staff, customers or patients, then the host stores that data on your behalf. Under the GDPR (in German the DSGVO, Datenschutz-Grundverordnung), Article 28 requires a written contract between you as the controller (Verantwortlicher) and the host as the processor (Auftragsverarbeiter). In German that contract is the Auftragsverarbeitungsvertrag, the AVV. The duty sits with you rather than with the provider, so ask before you order: is an AVV available, can you conclude it online, and does it name the sub-processors (Unterauftragsverarbeiter)?

Ask where the disks are as a separate question. You need the country for your own record of processing activities (Verzeichnis von Verarbeitungstätigkeiten), and because moving personal data outside the EU and the EEA needs its own legal basis. "A German company" and "disks in Germany" are different statements, and support staff reaching the machine from a third country is a third statement again. If a German location is the requirement, a VPS in Frankfurt answers it plainly, and VPS hosting for users in Poland is the same question one border to the east.

One thing you can do without a lawyer: encrypt before upload. restic and borg encrypt on the client by default, so the storage server holds ciphertext and its operator cannot read your files. Setting up restic backups to a VPS walks through that, and restic against borgbackup covers the choice between the two tools. Client-side encryption reduces what a host can see. It does not remove the contract requirement, because the provider still stores the data for you.

None of this is legal advice. Where personal data is involved, put the question to your data protection officer (Datenschutzbeauftragter) or to a lawyer, and get the answer in writing before the first upload.

What the offer does not say about RAID

Some plans state the RAID (redundant array of independent disks) level, some say only "redundante Speicherung", and some say nothing at all. A single disk with no redundancy is a legitimate cheap product as long as you know that is what you bought, so ask and get the answer in writing. RAID 10 for VPS storage explains what each level actually buys you.

RAID covers a disk failure. It does not cover you: an rm -rf on a mirrored array is applied to every disk at once, and recovering files deleted with rm -rf is a far worse afternoon than restoring from a second copy on other hardware.

The storage VPS checklist to paste into a pre-sales ticket

• Which disk class holds the capacity: HDD, SATA SSD or NVMe, and is there a published IOPS figure for this plan?
• Is the capacity quoted in TB or in TiB, and what will df -h report on delivery?
• How much traffic is included per month, at what port speed, and what happens when the fair use limit is reached?
• Are snapshots available on this plan, do they consume the quota, and are they stored on the same host as the volume?
• Is there root access, SSH key login, a console and a rescue system, and can you reinstall the operating system yourself?
• Which protocols are offered, and may you run your own daemon on the machine?
• What are the minimum term, the notice period, the renewal length and the setup fee?
• In which city and country are the disks, and can you choose the location at order time?
• Is an AVV available, and does it list the sub-processors?
• What is the RAID level, or the redundancy statement, in writing?
• Do you get an IPv4 address, an IPv6 address, or both?

Ask for the answers in a ticket rather than on the phone, because the ticket is the only record you will have on the day a number turns out to be different.

FAQ

Is a storage VPS the same as a Storage Box?

No. A storage box gives you protocol endpoints, such as SMB, NFS, SFTP, WebDAV and rclone, with no shell. A storage VPS gives you root, SSH and a machine you can install software on, so you can run an append-only restic REST server, verify and prune on the storage side, or replicate onward to a second target. If your workflow only writes files over SFTP, the storage box is cheaper and enough. If something has to run next to the data, buy the VPS.

Does "unlimited traffic" on a German offer really mean unlimited?

Usually it means a fair use policy (Fair-Use-Policy) described in the AGB. Ask for the volume at which the policy applies and what happens then: throttling (Drosselung), a per-terabyte charge, or a move to a larger plan. The number matters on the day you restore, because a restore pulls everything back at once. At 100 Mbit/s a single terabyte takes 22.2 hours at line rate, and a throttle turns that into days.

Do I need an Auftragsverarbeitungsvertrag for a backup server?

If your backups contain personal data about other people, the GDPR (DSGVO) treats the host as a processor acting for you, and Article 28 requires a written contract, called the AVV in German. Ask whether the provider offers one, whether it names its sub-processors, and which country holds the disks. Client-side encryption with restic or borg reduces what the operator can see, and it does not remove the contract requirement. This describes the requirement only. It is not legal advice.

How do I compare euro per terabyte between two offers?

Convert both to one monthly figure: annual price divided by 12, plus the setup fee spread over the months you plan to stay, plus tax if you cannot reclaim it. Then divide by usable capacity rather than advertised capacity, because 4 TB decimal shows as about 3.6 TiB in df -h, and ext4 reserves another 5 percent for root by default. Compare the two results in the same unit.

How can I tell whether my storage VPS is on HDD or on SSD?

Run lsblk -d -o NAME,ROTA,SIZE,MODEL first. A ROTA of 1 means the hypervisor is presenting a rotational device, but that flag is set on the virtual disk and is often wrong, so measure it. A 60 second fio random read at 4k with --direct=1 returns low hundreds of IOPS on a hard disk and tens of thousands or more on flash. Do it while the money back window is open.