Proxmox Backup Server: Your Local Backup Is Healthy, But Where Is the Offline Copy?

A properly deployed Proxmox Backup Server gives the impression that the job is done. Jobs turn green, deduplication delivers on its promise, integrity verification runs on weekends, and restoring a single file takes two minutes. At that point, the administrator has already done the hard part.

One question still remains, and many infrastructures answer it poorly: where is the second copy, the one that survives fire, water damage, or network encryption?

What the ANSSI Actually Says, and What People Claim It Says

This is where precision matters, because the shortcut is widespread. The ANSSI recommendations on information system backups (reference ANSSI-BP-100, "The Fundamentals", version 1.1 of November 27, 2025) state in R11 the "3 - 2 - 1" rule; and it must be read word for word:

It is recommended to apply the "3 - 2 - 1" rule: 3 distinct copies of the data, meaning production data and 2 backups stored on different media, including 1 offline.

Offline. Not off-site. The version that circulates in the market - "one off-site copy" - is therefore not the agency's rule: it is a weakening of the rule, slipped in somewhere between the guide and marketing brochures. And the next recommendation, R12, leaves no room for ambiguity:

It is essential to implement an offline backup (or at least an off-site online backup under certain conditions) even if it is less frequent than regular local online backups.

Three things are worth noting. First, the wording: "essential", not "recommended" - this is the only place in the guide where the agency uses that word about the medium. Then the order: offline first, off-site only as a fallback. A copy stored with a remote hosting provider but permanently reachable is the agency's second choice, not its first. Finally, and this is the part rarely quoted: ANSSI explicitly accepts that the offline copy be less frequent. It does not expect a daily cadence from a medium a human has to handle; it expects it to exist.

By the way, and because the confusion is widespread: the extended 3-2-1-1-0 rule is not an ANSSI recommendation. It comes from CISA and ENISA. Attributing it to the agency is a mistake your contact can verify in thirty seconds.

Three Real-World Setups, and Where They Break

The manually swapped disk. A USB drive or removable drawer, taken away every week by the administrator or business owner. It is the most common solution, the cheapest one - and, on paper, the most compliant with R12: it is truly offline. It relies entirely on a human habit. Two busy weeks, a vacation, or sick leave are enough for the backup to be a month old. And on the day it is needed, nobody has ever tested a restore from that disk.

The remote NAS. A second NAS at a partner's site, in another branch, or at the manager's home. Technically cleaner, since the copy runs by itself. But the NAS is reachable from the same network, often with the same credentials, and ransomware that gets hold of an administrative account reaches both sides within the same hour. A remote site is not isolation - that is exactly the distinction R12 makes between off-site and offline.

The second PBS at a peer's site. Exchanging datastores between two service providers looks elegant on paper: native replication, identical protocol, zero cost. It creates a mutual dependency that nobody contracts for, and it only takes one side changing infrastructure, shutting down, or getting encrypted for the arrangement to disappear without notice.

These three setups have one thing in common: they cost nothing as long as they work, and they cost everything the day they fail.

What a Managed Replication Target Brings

The good news is that PBS already knows how to do the job. Replication between two datastores is native, incremental, and requires no additional agent: you declare a remote, schedule a sync job, and snapshots move to the other site with their deduplication intact.

So what is missing is not a tool, it is a place: a remote datastore whose availability is guaranteed by someone else. Three properties make it different from a remote NAS:

• Identity isolation. The remote datastore is not in your directory and does not use your accounts. A compromise of your domain does not spread there.
• Immutability. A snapshot cannot be modified or deleted before its retention period ends, including by an administrator whose credentials have leaked. That is protection against a patient ransomware attack, which waits until the backups are corrupted before triggering.
• Independent retention. The remote site applies its own policy. A prune mistake on the local side does not replicate.

None of this requires changing client, migrating existing jobs, or abandoning your PBS. You add a destination and keep your infrastructure: that is what managed PBS backups are about; operation of the remote target is delegated, while the local PBS remains yours.

What It Costs - and Why Offline Costs More

Pricing for this type of service is typically calculated per terabyte and per month. RDEM Systems' pricing grid has a useful feature: it separates the two properties ANSSI distinguishes, instead of bundling them together.

No egress or restore fees. A detail that matters, since restore day is exactly when you do not want to discover a bill. The lineup then extends toward bank vault storage and tape archiving for long-retention requirements.

What is worth noting is that air-gap is not the top of a ladder: it is another axis. You can be off-site without being offline - which is the case for most market offerings - and you can be offline without being multi-site. The pricing grid therefore lets you combine exactly what the guide recommends: offline first, off-site as a complement.

And it is important to explain why offline is the more expensive of the two: not because storage itself is more expensive, but because a human handles the drives. By definition, a disconnected medium cannot be managed remotely: someone travels, unplugs, stores, plugs in the next one, and checks that the new drive is indeed receiving snapshots. The commitment is a monthly swap, which means there are always at least two drives offline, or two months of backups inaccessible over the network. That manual action is what ANSSI calls "offline", and it is what you pay for - not terabytes.

And that is exactly the regime R12 anticipates, since it accepts that the offline copy be "less frequent than regular online local backups". Announcing a monthly cadence is not an admission of weakness: it is the cadence you can maintain in all circumstances, including the month when a drive has to be replaced.

In other words, the constraint that makes the administrator-swapped disk fail is exactly the one that makes the air-gap offer more expensive. The difference is not the technology; it is that the gesture is contractualized and verified instead of merely hoped for.

And for those who hesitate between the two worlds, the guide itself provides the answer: it describes as an acceptable compromise combining regular backups with a WORM solution and less frequent offline backups. That is exactly what combining the two axes allows: replication runs continuously, physical isolation runs at its own pace.

For a small business with three hypervisors and 2 TB of useful snapshots after deduplication: €24 per month for simple off-site, €68 for offline, €92 for both - compared with the time of an administrator swapping a disk every week, and the residual risk when they forget.

Outsourcing the backup copy of a PBS is not a surrender of self-hosting: it is the complement to the part you cannot host yourself, by definition.

The Recommendation Nobody Applies

One requirement in the guide is discussed much less, and it may be the hardest one. R22: backups must be tested regularly, and a procedure for restoring the information system must be written and regularly carried out.

No datastore, however well operated, satisfies this requirement. It is not a feature; it is human time: mount a snapshot, restore a VM in an isolated environment, time it, and write down what was found. The opening question is simple, and few IT leaders can answer it: when was the last real restore, and how long did it take?

That falls under managed services, not a storage subscription: it is exactly what separates a rented datastore from a managed PBS, and that is the purpose of the periodic restore tests run by RDEM Systems for its managed-service customers, along with the corresponding report.

What About Windows Machines?

A fleet that is rarely homogeneous raises one last question: file servers, executive workstations, and business applications running on Windows do not naturally fit into a PBS, which is designed for Proxmox VMs.

The Windows backup client for PBS, licensed under GPL-3.0 fills that gap: graphical interface, consistent snapshots via VSS, file-level or full-disk backups, scheduled tasks, Windows service execution, and support for multiple PBS instances. The code is open, which makes it possible to audit what leaves the machine before deploying it across a fleet: a criterion that should be systematic for backup software.

Sponsored article.

adm_fb

See Full Bio