Verify jobs
Scheduled integrity checks detect silent data corruption before you need the backup - not during the restore attempt.
Restore tests with evidence
Regular restore tests into an isolated environment - documented. An untested backup is a hope, not a backup.
Set up and operate Proxmox Backup Server
Open-source backup for Proxmox VE: incremental, deduplicated and client-side encrypted with AES-256-GCM. We set up and operate PBS with verify jobs, an off-site copy and tested recovery.
- Deduplicated backups
- S3 backend (PBS 4.2)
- Restore tests by scope
Production-grade
Set up Proxmox Backup Server: what a production setup includes
Proxmox Backup Server provides the technology - deduplication, incremental snapshots, client-side AES-256-GCM encryption. Whether you can actually restore in an emergency is decided by the configuration around it. These six building blocks belong in every production PBS setup:
Prune & garbage collection
Retention policies (e.g. 7 daily, 4 weekly, 6 monthly) plus regular GC keep the datastore lean and consistent.
3-2-1 rule
Three copies, two media, one off-site: local PBS for fast restores plus an off-site copy via sync job or S3.
Encryption with key management
Client-side encryption means: no key, no restore. The encryption key must be stored safely - separate from the backup.
Monitoring & alerting
We proactively monitor failed jobs, capacity, and missing syncs around the clock before backup gaps appear.
Architecture
Backup architecture against ransomware
Attackers do not just encrypt production systems, they also target backups. The architecture must account for that: the off-site PBS pulls the backups itself (pull principle), credentials for the off-site target are not stored on the production host, and remove-vanished stays disabled so deletions at the source are not propagated (PBS documentation).
PBS on-site
Dedicated backup hardware in-house: fastest restores over the local network, control over data location and access. First line of defense for everyday cases (accidental deletion, broken VM).
Off-site PBS with pull sync
A second PBS in another fire zone or European data center pulls the backups via sync. Separate credentials, separate infrastructure, deletions at the source are not propagated.
S3 backend (PBS 4.2)
Object storage as a datastore, e.g. Hetzner Object Storage or MinIO: high capacity at low cost for long retention - officially production-ready since PBS 4.2.
For air-gap requirements, PBS additionally supports tape backups (LTO). Our guide PBS offsite backup explains the pull architecture in detail.
PBS offsite backupPBS 4.2
PBS 4.2: S3 backend for backups
With PBS 4.2 (29 April 2026), S3-compatible object storage as backup backend is no longer tech preview - it is production-ready.
Fits
Compatible S3 Backends
- Hetzner Object Storage
- MinIO (Self-hosted)
- AWS S3
- Wasabi
Avoid
Warning: Avoid S3 Object Lock
- Keep Object Lock disabled.
S3 Object Lock (WORM) breaks the PBS datastore structure. PBS needs the ability to delete chunks during garbage collection. Keep Object Lock disabled.
Managed PBS
Proxmox Backup Server as a managed service
You do not want to operate PBS yourself? We handle setup and operations - on your hardware or as a dedicated off-site instance on European infrastructure.
Managed Proxmoxfrom €179.90 excl. VAT / node and monthBackup management and monitoring are part of ongoing operations; restore tests and specific recovery objectives are explicitly agreed where required.
Managed Backup as a Service
- Setup & hardening
- Offsite replication via pull principle
- Backup monitoring and restore tests by scope
Other routes
Prove recoverabilityTest a Proxmox backup in practice, not just its job status
WZ-IT reviews PBS configuration, restores an agreed system in isolation and documents the recovery point, duration and required actions.
View restore test →For professional secrecy holdersOperate Proxmox in the Section 203 Managed Cloud
If Proxmox processes client, patient or other professional secrets, WZ-IT plans the application, infrastructure, access, backups and ongoing operations within a purpose-built operating model.
View the Section 203 Managed Cloud →Frequently Asked Questions
Answers to the most important questions
- PBS is the dedicated backup solution for Proxmox VE. It offers incremental backups with deduplication, client-side encryption (AES-256-GCM), and efficient compression. PBS integrates seamlessly with Proxmox VE and can be centrally managed via the web GUI.
- With client-side encryption enabled and keys managed separately from PBS, the server receives the backed-up contents encrypted. This protects their confidentiality if PBS is compromised, but does not prevent deletion or ensure availability. Independent offsite copies and tested recovery procedures are needed for that. See PBS encryption.
- Storage requirements depend on the data set, change rate, retention and measured deduplication and compression. Sizing is based on representative backups with a capacity reserve. No fixed savings ratio can be inferred in general. See PBS datastores.
- Yes. PBS can serve as a central backup server that backs up VMs from multiple Proxmox instances - even across provider boundaries. The requirement is a network connection (VPN or public with encryption) between the Proxmox hosts and the PBS.
- Through architecture: the off-site PBS pulls the backups itself via pull sync, and credentials for the off-site target are not stored on the production host. This limits the host’s direct access; it does not amount to absolute ransomware protection. The sync job runs with remove-vanished disabled so deletions at the source are not propagated, and retention, pruning and garbage collection are configured independently on the off-site PBS (PBS documentation). Verify jobs additionally check integrity, and for air-gap requirements PBS supports tape backups (LTO).
- vzdump creates full backups as single files - without deduplication, incremental backups or verification. With more than a handful of VMs, storage requirements and backup windows explode. PBS backs up incrementally with deduplication, verifies integrity and manages retention automatically - clearly the better way for production.
- Managed Proxmox from €179.90 net per node and month includes PBS backup management and monitoring where PBS forms part of the environment. Restore tests, off-site architecture, and specific recovery objectives are explicitly agreed where required. A standalone managed PBS is priced by scope.
- Yes. We plan, install, and configure your Proxmox Backup Server - whether on dedicated hardware, as a VM, or with a separate provider. Backup jobs, retention policies, and monitoring are configured for the target design; documented restore tests can be added.
- HTTPS uses TCP port 8007. See the PBS documentation and PBS basics.
- Technically yes; backup storage and recovery must not depend solely on the protected host. The PBS basics explain the operating boundaries.
- Yes. Features, licensing and the operating model differ. The PBS vs. Veeam comparison explains both paths.
Knowledge
Further Reading
Guides
Managed Operations for Proxmox
Related tutorials & guides
- MinIO is archived: self-hosted S3-compatible storage comparedFor years MinIO was the default answer to self-hosted S3-compatible storage. That answer no longer holds: the public repository is archived and the last push...
- restic, Borg or Kopia: backup tools compared for business operationsThere is no shortage of comparisons between restic, Borg and Kopia, and almost all of them come from the homelab world. Different things matter there:...
- Proxmox Backup Server 4.2: S3 Storage Exits Tech Preview — What You Need to KnowWith Proxmox Backup Server 4.2 (released late April 2026), S3-compatible object storage is officially supported as a backup backend. No more tech preview label, no...
Reviews & projects
Proxmox proof from real projects
Customer feedback on virtualization, backup, VPN, security and ongoing cluster operations.
WZ-IT moved our studio infrastructure from decentralised individual devices to a central platform: every site is securely connected via VPN, new devices are onboarded automatically and an entire site is provisioned from a template, without manual steps on location. What impressed me most is the breadth and depth of their knowledge: Timo and Robin are not a typical IT provider who sets up a server and leaves. The two of them think their way into highly complex infrastructure and software topics, work through every requirement we put in front of them, and build networking, provisioning and operations so that everything fits together in the end. WZ-IT is an excellent partner for complex software, network and architecture projects.
Steve KirchnerManaging Director, nextGYM GmbH
International
Built in Germany's Ruhr Valley. Running worldwide.
WZ-IT designs, develops and operates infrastructure and software for clients in Germany and internationally. We deliver projects remotely and continue supporting them in ongoing operations after go-live.
Selected projects
- LiveRemote access platform for distributed water treatment plantsABCO Water Systems · Australia · Secure Access & OT
- 81%AWS migration with substantially lower operating costsEVA Real Estate · UAE · Cloud exit & infrastructure
- 98%Provision new sites in minutes instead of hoursnextGYM GmbH · Germany · Automation & IoT
Read client reviews
Enquiry
Scope Proxmox Backup Server
Name data volume, change rate, retention, and required off-site copy.
- Straight with Timo and Robin - no sales team, no pitch
- A professional assessment of your situation
- Concrete next steps for infrastructure, software or AI
The conversation is free and non-binding.
WZ-IT's advice on our Azure migration was technically sound and completely non-binding right from the intro call - we took away a great deal.
Jakob ÖschlbergerInno7 GmbH
WZ-IT's advice on our Azure migration was technically sound and completely non-binding right from the intro call - we took away a great deal.