Storage VPS or a managed storage box?

Storage VPS or managed storage box: the short answer

A storage VPS is a virtual machine with large disks, root access, and a network address that belongs to you. A managed storage box is a quota sold by the terabyte, reachable over SMB, WebDAV, SFTP and rsync over SSH, with no shell on the far end. If the only job is receiving backups that were already encrypted before they left your machine, the managed box usually wins, because you are paying for capacity and for someone else's redundancy. The moment you want to run code against the data, the box cannot help you, because there is nowhere on it to run code.

That is the whole boundary. Everything below is where it bites. The separate question of how a large-disk plan differs from an ordinary compute plan is answered in how a storage VPS differs from a regular VPS, so this guide compares the VPS against the managed product only.

What a managed storage box actually is

The provider runs the filesystem, the disks and the daemons. You get a login, a quota, and a fixed set of protocols. Most of these products also offer read-only snapshots, sub-accounts with their own directory and quota, and a WebDAV endpoint you can mount with davfs2. The exact list varies between providers, so read the feature page of the one open in your other browser tab.

One feature deserves its own sentence, because people misread it. "Supports BorgBackup" means the provider runs borg serve on their side. Borg is a client/server program: the client does deduplication, compression and encryption, and the server does the low-level repository operations. Without a Borg process on the remote host, Borg falls back to plain filesystem calls over the network, so every operation makes a round trip and the Borg FAQ tells you to avoid it. You cannot install borg serve on a box with no shell, which is why this is a feature the provider either ships or does not.

What only a storage VPS gives you

Root. That one word covers most of the list, but the specific things people miss are worth naming.

• Any daemon you want. A restic REST server, an S3 compatible object store, a sync client, a database. Running MinIO for an S3 API of your own turns the same disks into something your application code can talk to.
• Append-only enforced by you. This is the single most important capability difference for backups, and it has its own section below.
• Compute next to the data. restic check --read-data and borg check --verify-data read every byte in the repository. On a VPS you run them over SSH against a local path and nothing crosses the internet. Against a managed box, the same command pulls the entire repository down your line.
• Your own SSH configuration. Per-key forced commands, the restrict option, a non-default port, a Match block for the backup user. On a managed box you get a form to paste a public key into and the rest is theirs.
• Docker, and everything downstream of it. A Nextcloud instance with TLS and its own backups is a compose file on a storage VPS, and is impossible on a box.
• Restores that start locally. Mount a Borg archive on the storage machine itself and copy out the one directory you need, instead of pulling a full snapshot home first.

One item that sounds like it belongs on that list does not: encryption at rest that you control on the server. You can put LUKS on a data volume on a VPS, but the volume has to be unlocked at boot, so either you type a passphrase into a console after every reboot or the key file sits on the same machine. The hypervisor operator can also read the memory of a running guest. On both products the measure that actually protects the data is client-side encryption, done by Borg or restic before anything leaves the source machine. The difference is that on a VPS you also control the process that receives it.

Why append-only backups need a VPS

A backup client holds the credentials for the backup repository. That is unavoidable, because it has to write. So anyone who takes over the source machine can also reach the repository and delete it. Append-only mode is the answer: the repository host accepts new data and refuses deletions, so stolen credentials are not enough to destroy the history.

With Borg, append-only is a forced command in authorized_keys on the repository host.

command="borg serve --append-only --restrict-to-path /srv/borg/web01",restrict ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA... web01-backup

That line lives in /home/borg/.ssh/authorized_keys on the machine holding the repository, and writing it requires a shell on that machine. A managed box gives you a key upload form, and the forced command behind that form is the provider's, so you get append-only only if they ship it as a product feature. Read their documentation instead of assuming.

With restic the gap is wider. The SFTP backend is a filesystem protocol, so a client that can write can also delete, and there is no server-side switch to stop it. Append-only for restic exists only in the REST backend, in a daemon called rest-server, started with --append-only. A daemon needs a machine you can run daemons on.

Pointing Borg at each one

Against a managed box, the SSH port is often not 22. Take the one your provider documents.

ssh-keygen -t ed25519 -f /root/.ssh/id_backup -C "borg web01"
# paste /root/.ssh/id_backup.pub into the provider's panel
export BORG_RSH='ssh -i /root/.ssh/id_backup'
borg init --encryption=repokey-blake2 \
  ssh://u123456@u123456.storagebox.example:23/./backups/web01

The /./ after the port means the path is relative to the account's home directory. A single slash makes it absolute, which a managed account will usually refuse with a permission error. repokey-blake2 stores the encryption key inside the repository, protected by your passphrase, so keep that passphrase somewhere that is not the machine being backed up.

export BORG_PASSPHRASE='...'   # or BORG_PASSCOMMAND reading from a secret store
borg create --stats --compression zstd,3 \
  ssh://u123456@u123456.storagebox.example:23/./backups/web01::web01-{now:%Y-%m-%dT%H:%M} \
  /etc /srv /home

A healthy run ends with a statistics block listing the number of files and the deduplicated size. borg list against the same repository URL should then print the archive by name. If it prints nothing, the archive was not committed.

On your own storage VPS the repository is a directory you own.

sudo apt update && sudo apt install -y borgbackup
sudo adduser --disabled-password --gecos "" borg
sudo install -d -m 700 -o borg -g borg /home/borg/.ssh
sudo install -d -m 700 -o borg -g borg /srv/borg/web01

Add the forced-command line from the section above to /home/borg/.ssh/authorized_keys, then initialise from the client with an absolute path.

borg init --encryption=repokey-blake2 ssh://borg@storage.example.com/srv/borg/web01

Run borg --version on both sides. A client on a newer major version refuses to talk to an older server, and on a managed box the server version is the provider's choice, not yours. On your VPS both ends are your choice, so you upgrade them together.

restic: SFTP to the box, rest-server on the VPS

restic reaches a managed box over SFTP. Put the unusual port in ~/.ssh/config rather than in the repository string, because the URL form that carries a port needs an awkward double slash.

Host storagebox
  HostName u123456.storagebox.example
  User u123456
  Port 23
  IdentityFile /root/.ssh/id_backup

restic -r sftp:storagebox:/backups/web01 init
restic -r sftp:storagebox:/backups/web01 backup /etc /srv

Drop the leading slash to get a path relative to the account home, which is what most managed accounts expect: sftp:storagebox:backups/web01.

On a storage VPS you run the REST server instead, and append-only comes with it. rest-server is a single Go binary from the project's releases page, and there is an official container image you can pull with docker pull restic/rest-server:latest.

sudo apt install -y apache2-utils
sudo install -d -m 700 /srv/restic
sudo htpasswd -B -c /srv/restic/.htpasswd web01
rest-server --path /srv/restic --listen 127.0.0.1:8000 --append-only --private-repos

Bind it to loopback and put a TLS reverse proxy in front of it, or reach it over a VPN. Then the client talks to it over HTTPS.

restic -r rest:https://web01:PASSWORD@storage.example.com/web01/ init

--private-repos means the user web01 can reach /web01/ and nothing else, so one compromised host cannot read another host's snapshots. If restic is new to you, the full restic setup on a VPS covers scheduling and retention, and the comparison between restic and BorgBackup covers which tool fits your data. Whichever you pick, writing every backup to two repositories is what turns one storage target into a backup strategy.

What a German price tag really says

German hosting offers aimed at businesses are usually advertised net, with "zzgl. MwSt." beside them. The VAT rate is 19 percent as of September 2026. The figures below are arithmetic, not a price list. Check the provider's own page on the day you buy.

[
  {
    "label": "5 EUR net",
    "net_eur": "5.00",
    "gross_eur": "5.95"
  },
  {
    "label": "10 EUR net",
    "net_eur": "10.00",
    "gross_eur": "11.90"
  },
  {
    "label": "20 EUR net",
    "net_eur": "20.00",
    "gross_eur": "23.80"
  },
  {
    "label": "40 EUR net",
    "net_eur": "40.00",
    "gross_eur": "47.60"
  }
]

A headline of 10.00 EUR net is 11.90 EUR on the invoice for a private customer in Germany, and 40.00 EUR net becomes 47.60 EUR. A business with input tax deduction (Vorsteuerabzug) reclaims that VAT, so for a company the net figure is the real cost. A business elsewhere in the EU holding a valid VAT identification number is normally invoiced at zero percent under the reverse charge rule and accounts for the tax at home. Confirm it in the order form, because it depends on the number you enter there.

The comparison goes wrong when one browser tab shows net and the other shows gross. Consumer-facing pages in Germany have to display gross prices, business-facing pages usually show net, and the same product therefore looks 19 percent cheaper for no reason at all. Put both offers on the same basis before you compare a euro per terabyte figure.

Two costs sit outside the monthly line. The first is traffic: managed boxes commonly include it, while VPS plans carry a monthly allowance, and restoring several terabytes can pass that allowance and trigger an overage charge. The second is your time, because a VPS is a machine you patch, monitor and answer for. If cost is the deciding factor, run the honest arithmetic against a consumer cloud plan and the price of a cheap terabyte across block and object storage first. Both start from a real estimate of the capacity you need, which is usually smaller than the number you picked from memory.

DSGVO: where the disks sit, and what you sign

Both products are commonly hosted in German or other EU facilities, and both providers are Auftragsverarbeiter (processors) under Article 28 of the DSGVO when they hold personal data for you. That means you need an Auftragsverarbeitungsvertrag (AVV), the data processing agreement. German providers usually publish one you accept inside the control panel. A German data centre does not remove that requirement. It removes the third-country transfer question, which is a different problem.

Encryption changes the risk, not the paperwork. Borg and restic encrypt on the source machine, so what the provider stores is blobs it holds no key for, which is a strong technical measure under Article 32. You still sign the AVV. Ask which city the storage sits in and whether the provider replicates it anywhere else, because "EU" and "Germany" are not the same answer. EU data residency and what it adds to the bill works through that in detail.

Where each one breaks

These are the managed box failures you will actually meet.

• Quota full. The write fails part way and the repository is left locked. Clear it with borg break-lock or restic unlock before the next run, then raise the quota or prune.
• A stale lock from a dropped connection. Same two commands. It happens more often over a mounted share than over SFTP or borg serve.
• A repository on a davfs2 or cifs mount. Locking and rename behaviour on those mounts does not match a local filesystem, so a repository placed there collects broken locks. Use the SFTP or Borg transport instead of mounting the box and treating it as a disk.
• Verification pulls everything. restic check --read-data reads the whole repository, and with no shell on the far end that traffic crosses your line. Budget hours for it and pick a schedule you will actually keep.
• Their software version, on their timetable. An upgrade on your side can outrun the server side, and you cannot fix the server side.

These are the storage VPS failures you own.

• Disk full. No space left on device in the middle of a backup, followed by a lock to clear. Alert on free space well before it reaches 100 percent, because a repository that fills up fails every night afterwards.
• Patching. sshd, the kernel, the container runtime, and whatever daemon you exposed. Nobody else is doing it.
• One machine. Host-side RAID survives a dead disk. It does nothing about your own rm -rf, a billing lapse, or a data centre event. A storage VPS on its own is a copy, not a backup strategy.
• Abuse and liability. The IP address is yours. An open object storage console or a misconfigured Samba share becomes your abuse ticket to answer.
• Uptime is yours to defend. Nobody is on call for your systemd unit at 03:00.

The decision rule

If the only job is offsite storage of data that is already encrypted before it leaves the source machine, buy the managed box. You are paying for capacity and for someone else's redundancy, and you take on no patching, no abuse liability and no uptime to defend. That is the common case, because an offsite target for a Borg or restic repository does not need to think.

The moment you want to run anything against the data, buy the storage VPS. "Anything" covers verifying a repository without pulling every byte across the internet, enforcing append-only yourself, serving files over an S3 API, running a sync client, extracting one directory locally, or scanning the data for a compliance request. None of it is possible on a product whose entire interface is a file protocol.

There is a third answer worth the money surprisingly often: both. The managed box is the cheap far copy at one provider, the storage VPS is the working copy you can operate on at another, and the two sit in different failure domains. Before you buy either one, the checklist of things to confirm with the provider first will save you a migration later.

FAQ

Can I use BorgBackup with a managed storage box?

Only if the provider lists BorgBackup as a supported feature, because Borg needs a borg serve process on the remote host. The client does deduplication and encryption, the server does the repository operations, and with no shell on the box you cannot install that process yourself. Providers who support it document the SSH port, which is often not 22, and the repository path form, which is usually relative to your home directory and written as /./backups/name after the port.

Is a storage VPS cheaper per terabyte than a managed storage box?

Usually not. Managed boxes are sold as capacity with very little compute behind them, so the euro per terabyte is normally lower. Put both offers on the same tax basis before you decide, because German business pages show net prices and consumer pages show gross prices, and 19 percent is enough to reverse a close comparison. Then add the VPS traffic allowance and the hours you will spend patching it.

Do I need an Auftragsverarbeitungsvertrag for either one?

Yes, for both, whenever the stored data includes personal data of other people. Both providers act as processors under Article 28 DSGVO, and encrypting client-side does not remove the contract requirement. It does make the storage layer far less sensitive, since the provider holds blobs it has no key for. Most German providers publish an AVV you can accept inside the control panel.

Can I get append-only backups on a managed storage box?

Only if the provider offers it as a feature. Append-only for Borg is a forced command in authorized_keys on the repository host, and you have no shell there to write one. restic has no append-only mode over SFTP at all, because the protocol lets any writer delete. If append-only matters to you, and for ransomware resistance it should, run rest-server with --append-only on a machine you control.

Is a storage VPS a backup by itself?

No. It is one machine, in one data centre, with one filesystem. Host-side RAID survives a dead disk and nothing else. A backup means a second copy in a second failure domain, which is why a managed storage box and a storage VPS work better as a pair than as competitors.