Self-Hosted Cloud: Part 3 — Cloud or Your Own Server for Company Data

Where to store a company’s files, databases, and backups — on your own equipment or in a provider’s cloud — is not a technical question, but an economic and legal one. The answer determines expenses for several years ahead, who is responsible for failures, and compliance with the personal data law.

Two approaches

Own equipment (on-premise). A server or network storage sits in the office or in a rented rack at a data center. The company buys it, configures it and maintains it itself or via a contractor. Typical options:

• ready NAS, for example Synology — a box with a web interface, shared folders and built-in backup tools;
• TrueNAS — an open system for storage on the ZFS filesystem with checksums and snapshots (more — in the article about TrueNAS);
• virtualization server on Proxmox VE, where the storage is one of the virtual machines (see the section on Proxmox VE of the “Virtualization” series);
• on top of any of these — your own file service like Nextcloud (see part 1 of this series).

Cloud. Space is rented from a provider: as S3 object storage, a cloud drive or a virtual server. The provider is responsible for hardware, power and redundancy within its data center; the company pays monthly for volume and traffic.

Cost: calculate over three to five years

You should compare not the purchase price with a month of rent, but the total cost of ownership over the equipment’s service life — usually three to five years.

For own equipment, include:

• server or NAS and disks, with spare capacity for growth and for disk failure (RAID or ZFS mirror doubles the number of disks);
• uninterruptible power supply and, if the equipment is in the office, a place with normal temperature;
• a second storage or external media for backups — a copy on the same device is not a backup (see the 3-2-1 rule);
• disk replacement and repairs, usually in the third to fifth year;
• administrator time for updates, monitoring and restore verification;
• internet connection and a static IP, if external access to the data is needed.

For the cloud:

• fees for stored volume and for outgoing traffic (many providers have free ingress but charge egress — this matters if data is frequently downloaded);
• fees for requests to object storage with a large number of small files;
• the bill growing with data volume: in a few years the monthly payment may exceed the cost of owning equipment.

Practical rule: a small volume that grows unpredictably is cheaper to keep in the cloud; a large and stable volume that is frequently accessed inside the office is usually cheaper on your own equipment.

Risks

The cloud removes hardware risks from the company, but not responsibility for backups and access rights.

Legal requirements: 152-FZ

If the data contains personal data of Russian citizens — customers, employees, website submissions — a localization requirement applies: from July 1, 2025 the recording, systematization, accumulation, storage and clarification of such data must be carried out in databases located in the territory of Russia (part 5 of article 18 of 152-FZ as amended by law No. 23-FZ). The primary database cannot be stored with a foreign cloud provider.

For choice this means:

• own equipment in Russia complies with the requirement;
• cloud is suitable if the provider’s data centers are located in Russia;
• foreign clouds are not suitable for such data, even if payment is possible.

Which clouds are available in Russia

The major foreign platforms are effectively closed for Russian companies: Google Cloud has not accepted new clients from Russia since March 2022, and you cannot pay AWS, Google or Microsoft with a Russian card — Visa and Mastercard suspended operations in the country. The real choice is Russian providers with S3-compatible object storage and data centers in Russia:

• Yandex Cloud — Object Storage;
• VK Cloud — Object Storage;
• Selectel — S3 storage.

They all work over the S3 protocol, so the same backup and sync programs connect to any of them. How the protocol itself works is discussed in the part about S3 of the “File transfer protocols” series; a comparison of cloud storages for backups is in part 3 of the “Backup” series.

Hybrid setup

For a small company a hybrid is most often reasonable:

1. Working files and databases — on your own storage in the office: fast access, no traffic charges, data stays in the country.
2. Daily backup — to a Russian object storage with versioning enabled or object lock so that ransomware cannot delete it.
3. Once a month — verify restore from the cloud copy.

This satisfies the 3-2-1 rule: three copies, two types of media, one copy off-site. The cloud here plays the role of an external site, not the primary storage.

How to choose

Own equipment is suitable if:

• there is a lot of data and it is mainly needed by employees inside the office;
• there is an administrator — in-house or outsourced;
• full control and compliance with 152-FZ without dependence on a provider are required.

Cloud is suitable if:

• the data volume is small or changes a lot;
• employees work from different places;
• there is no person to monitor the equipment.

Hybrid suits almost everyone for whom data is important: the primary storage is where it’s most convenient to work, the copy is elsewhere.

Common mistakes

• Storage without a backup. RAID protects against disk failure, but not against deletion, ransomware or fire.
• A cloud drive instead of a backup. Syncing uploads deletions and encryptions to the cloud as well.
• Calculating only the purchase price. Without the cost of replacement disks, UPS, copies and admin time, own equipment looks cheaper than it is.
• Traffic not accounted for. If cloud data is frequently downloaded, egress charges can exceed storage fees.
• Personal data abroad. A primary customer database with a foreign provider violates the localization requirement.