MENU

A shared folder full of quotes, staff records or customer documents should not be exposed to the internet because somebody ticked the wrong setting. That is the real question behind “are self-hosted clouds secure?” A self-hosted cloud can be very secure, but it is not secure by default simply because the server is in your office or under your control.

For a small business, self-hosting means you decide where files live, who can access them and which provider has access to the underlying hardware. That is valuable for privacy and control. It also means the responsibility for updates, backups, access controls and recovery sits with you, or with the IT team managing the system.

Are self-hosted clouds secure when properly managed?

Yes. A properly configured self-hosted cloud can offer excellent protection for business files. It can keep data on a server you own or rent, use encrypted connections, enforce multi-factor authentication and provide detailed control over staff accounts and shared folders.

The key difference is management. A large cloud provider has dedicated teams maintaining data centres, patching infrastructure and monitoring threats around the clock. A self-hosted setup does not automatically come with that level of operational cover. It needs to be designed and maintained with the same care.

Security is therefore less about whether the word “cloud” appears in the product name and more about a few practical questions: Is the server patched? Are accounts properly controlled? Is there a tested backup? Can someone spot and respond to a problem quickly?

A business with a maintained self-hosted system can be safer than one using a public cloud with weak passwords, unrestricted sharing links and no visibility over who has access. Equally, an unpatched server exposed directly to the internet can become a problem very quickly, even if it is sitting in a locked office.

Where self-hosted cloud security goes wrong

Most incidents are not caused by a dramatic Hollywood-style hack. They come from ordinary gaps that build up over time: a former employee still has an account, an administrator password is reused, a software update is delayed, or a backup has been running but has never been checked.

The first major risk is internet exposure. Remote access is useful for staff working from home, travelling or visiting clients. However, putting a cloud login page directly on the internet creates a target for password attacks and software exploits. The service should be protected with a correctly configured firewall, encrypted HTTPS access and, where appropriate, a VPN.

The second is identity management. Every user should have their own account. Shared logins make it difficult to identify who accessed, deleted or shared a file, and they make offboarding far harder. Multi-factor authentication adds a vital second check, particularly for administrators and remote users.

The third is patching. Cloud platforms, operating systems, databases and plugins all receive security fixes. Delaying updates can leave known weaknesses open for attackers to exploit. Updates need planning, especially where a business relies on a particular workflow, but “we will do it later” is not a security policy.

Finally, there is ransomware. If an infected laptop has access to a synchronised folder, it may encrypt files on the server and synchronise the damaged versions elsewhere. File versioning and isolated backups are essential because they give you a route back when prevention fails.

The controls that make the difference

A secure setup starts with the server itself. It should run a supported operating system, have only necessary services enabled and be located in an environment with reliable power, cooling and physical access control. A server in a cupboard beside cleaning supplies, connected to an ageing domestic router, is not a sensible foundation for important company data.

Data travelling between a user’s device and the cloud should always be encrypted. So should sensitive data stored on the server, particularly if the equipment could be stolen or is hosted outside your premises. Encryption protects the data, but key management matters too. If encryption keys are stored carelessly or recovery details are lost, encryption can create its own access problem.

Permissions should follow the principle of least privilege. Put simply, people should have access to the files they need for their job and no more. A finance folder does not need to be visible to every member of staff. Temporary access for an external accountant or contractor should have an expiry date rather than becoming a permanent account nobody remembers.

For a small organisation, these controls are worth treating as a standard baseline:

• Unique user accounts, strong passwords and multi-factor authentication.
• Regular security updates for the server, cloud software and connected devices.
• A firewall configuration that limits exposure, with remote administration restricted.
• Encrypted connections and sensible folder permissions.
• Monitoring and audit logs that show failed sign-ins, account changes and unusual activity.
• Tested backups kept separately from the main cloud server.

These measures do not need to make daily work difficult. A well-run system should be straightforward for staff: sign in securely, find the correct files and share them with the right people. Security that blocks normal work tends to be bypassed, so the design needs to be practical.

Backups are separate from synchronisation

This point catches many businesses out. Synchronisation copies changes between devices. Backup preserves a recoverable copy from an earlier point in time. They are not the same thing.

If a user deletes a folder, synchronisation may remove it everywhere. If ransomware encrypts files, synchronisation can spread the encrypted copies. Version history can help, but it should not be the only recovery plan.

Keep backups separate from the main system, ideally with more than one copy and at least one copy protected from normal user access. A backup connected permanently with full write access can be encrypted by ransomware alongside the live files. More importantly, test restoration. A backup is only useful if you can recover the files you need within a sensible timeframe.

Self-hosted cloud versus public cloud

Public cloud storage is not inherently less safe. Major providers invest heavily in infrastructure security, redundancy and monitoring. For some businesses, it is the right choice, particularly where there is no capacity to manage servers or where staff need simple collaboration across several locations.

Self-hosting becomes attractive when privacy, data location, customisation or long-term control matter more. It can avoid reliance on a single vendor and can integrate closely with your existing users, local file systems, VPN and backup arrangements. You also have clearer control over where company data is held and how it is retained.

The trade-off is straightforward: greater control brings greater responsibility. With public cloud services, you still need to manage users, sharing and endpoint security. With a self-hosted cloud, you also need to manage the underlying service, its updates, its network and its recovery plan.

There is also a middle ground. A business may keep day-to-day file storage on a self-hosted cloud while maintaining encrypted off-site backups, or use a managed server hosted in a professional data centre. The best arrangement depends on the size of the team, the sensitivity of the data, internet reliability, budget and the time available to maintain it properly.

Questions to ask before moving files

Before migrating data, check what you are actually trying to solve. If staff simply need a shared drive, the setup may be relatively simple. If you need remote working, external sharing, mobile access, client portals and compliance controls, the design needs more thought.

Ask who will administer the system when the usual person is on holiday or leaves the business. Ask how quickly critical files must be restored after a fault. Ask whether staff laptops are encrypted and patched, because a secure server cannot fully protect data downloaded to an unsecured device.

It is also worth reviewing your internet connection and power protection. A local server may be secure but unavailable during an outage. For many Dundee businesses, a sensible plan includes a battery backup, monitoring, off-site recovery copies and a clear support contact when something stops working.

DCC Workshop can help businesses plan and maintain self-hosted cloud storage as part of wider server administration and outsourced IT support. The aim is not to add technology for its own sake. It is to give staff reliable access to the files they need without leaving the business exposed.

The safest cloud is the one your business can maintain, monitor and recover with confidence. Start with the data that matters most, set clear access rules, and make sure your backup has been tested before you need it.