1C: Part 3 — Cloud Providers and Access Control

Cloud 1C relieves you of server maintenance, but not of choosing a provider or of responsibility for access to your data. In this part — how cloud services differ, how much they cost, how to retrieve your data, and how to secure access to the accounting system.

Three types of cloud services

• Service with standard configurations (SaaS). The provider offers ready-made applications — “Accounting”, “Our Company Management”, “Payroll and HR”. Updates and backups are the provider’s responsibility; configuration customizations are not possible. Example — 1C:Fresh.
• Renting 1C from a partner. The provider hosts databases on their servers, gives access to the configurator and allows customized configurations. Work is done via thin client, browser, or remote desktop.
• Virtual server. The provider gives only the server, and you install the platform, DBMS and licenses yourself. This is effectively your own server, just in someone else’s data center.

1C:Fresh

The cloud service from the company “1C”. Works in a browser, via thin client or mobile app. Only standard configurations are available; updates are installed automatically.

Official rates as of September 2026:

Payment is possible for 3, 6 or 12 months. The service is also sold by 1C partners: for example, Scloud offers 1C:Fresh from 755 ₽ per month per user with a minimum of two users, which corresponds to the official basic plan.

Renting from partners

With partners you can work with customized configurations and get access to the configurator. For example, at Scloud — an official 1C partner — renting 1C costs from 1 600 ₽ per month per user, the first 14 days are free, and access is possible via remote desktop. Terms vary significantly between providers, so compare them using a single checklist of questions.

How to retrieve your data

The ability to obtain a full copy of the database at any time is the main condition to check before starting work.

In 1C:Fresh this can be done without contacting support in two ways:

• backup copy — the subscriber owner in the personal account opens the list of application archive copies, selects the desired one and clicks “Download file”;
• export file — a user with administrator rights in the application itself selects “Transfer application data” and the mode “Get export file for manual transfer”.

The obtained file is loaded into the local PROF or CORP version. You cannot load cloud data into the basic version, except for 1C:Entrepreneur, which is transferred into the basic “Accounting”.

With partners who provide access to the configurator, exporting to .dt is done independently. If the provider issues a copy only on request, clarify the timeframe and cost.

What to check before choosing a provider

1. Where the servers are located. Accounting databases almost always contain personal data, and under Federal Law No. 152-FZ their initial recording and storage must be carried out in Russia.
2. Backups. How often they are taken, how long they are stored, where they are stored, who and how quickly restores the database to a chosen date.
3. Data export. Whether you can obtain a copy yourself and in what format.
4. Customizations. Whether customized configurations and extensions are supported, and whether there is access to the configurator.
5. What is included in the price. ITS, 1C-Reporting, number of databases and users, disk space.
6. Availability. What level of availability is guaranteed by the contract and what the provider compensates in case of violation.
7. Termination of the contract. How long data is stored after payment ends and how to retrieve it.

Access protection

A cloud database is available from the Internet, so the password remains the main but not the only line of defense.

Two-factor authentication

Two-factor authentication appeared in 1C:Fresh in July 2025. Each user enables it themselves: a one-time code is sent to email or generated by an authenticator app. Note that after enabling it, integrations that use the user’s login and password and are included in the service stop working: they require a separate account.

The 1C:Enterprise platform itself also supports a second factor: the platform verifies the password, and the code is delivered or verified by an external provider, for example an SMS service. If 1C is hosted by a partner or on your own server, check whether this mechanism is configured.

IP address restriction

The provider or your administrator allows connections only from office IP addresses. This blocks password-guessing from the Internet, but is inconvenient with dynamic addresses and does not work for traveling employees. A sensible combination is to whitelist the office and require VPN for others.

VPN

An employee first connects to the VPN, then to 1C. Traffic is encrypted and the 1C server is not visible from the Internet. WireGuard and OpenVPN are suitable for in-house infrastructure. If the VPN is provided by the provider, check whether it is included in the plan.

Remote desktop

Direct RDP access to the server with 1C from the Internet is one of the most common causes of ransomware infections. The RDP port should not be open externally: connections only via VPN or a remote desktop gateway, with account lockout after several failed login attempts.

User rights

• each employee has their own account; no shared logins;
• roles are limited to tasks: a cashier does not need payroll access;
• on dismissal the account is disabled the same day;
• the 1C audit log is periodically reviewed for logins at unusual times and mass deletions.

Conclusion

When choosing a cloud for 1C, compare not only the price per user, but also data storage and export conditions, backups and methods to secure access. The minimum requirement for any cloud database is the ability to independently obtain a copy of the data, two-factor authentication and no open RDP.