Private storage is a system, not just a NAS
A NAS (a box of disks that shares files across your network) keeps your files on equipment you control. On its own it also gathers your photos, business records and work into one place.
Buying the box is the easy part. Private storage only works when the live files, who can reach them, snapshots, a separate backup, an off-site copy, encryption, remote access and a tested way back are designed together. RAID is not a backup. Sync is not a backup. Opening the box to the internet changes the risk. And whoever runs it inherits the patching and the recovery.
What you gain, and what you take on
Cloud storage makes somebody else responsible for much of the physical infrastructure. Self-hosting changes who holds the files, but it also hands the operating work to you.
That trade can be worth it. Sensitive files can stay on premises you control. Access can follow your rules. A file share keeps working across your local network. And the exit path does not begin with downloading everything from a provider you are leaving. This guide sits inside our own your data hub.
It is not automatically safer. Australian cyber guidance notes that a suitable managed SaaS service can reduce the customer's direct security responsibilities (ACSC cloud shared-responsibility guidance). The honest choice rests on how sensitive the data is, who will look after it and how you would recover, not ideology.
At a glance
| Question | Practical answer |
|---|---|
| Helps with | Local custody, controlled sharing, fast local access, file versions and a deliberate plan for what you keep |
| Does not solve | Deletion, ransomware, fire, theft, operator error or hardware failure, unless independent recovery copies exist |
| Difficulty | High once shared access, remote use, application data and recovery are included |
| Relative cost | $$$ to $$$$ for multi-disk storage, separate backup media and appropriate resilience |
| Maintenance | Security updates, disk and capacity monitoring, permissions, backup jobs, key custody and restore tests |
| Ordinary-user fit | Best as a supported system; for modest needs a simple external backup drive may be safer |
Cost bands are relative and exclude Alien IT labour. Capacity, resilience and compatibility must be assessed against the actual workload.
The seven separate parts of private storage
1. Live storage
This is the working copy: shared folders, photos, databases and application data. Several disks can keep it available through a disk failure, but the box itself is still a single point of failure: fire, theft, a bad update or a wrong click reaches every disk in it.
2. RAID or disk redundancy
RAID can keep the system running through a supported disk failure. It is not a backup. A mistaken deletion, a ransomware process, a faulty update, a stolen enclosure, a fire or an administrator's slip can affect the whole array at once. We cover this in more detail in RAID is not a backup: the 3-2-1 rule explained.
3. Snapshots and file versions
Snapshots give you a fast way back after an accidental change or deletion. But kept on the NAS, they sit in the same box, under the same administrator, as the data they protect. If an attacker, a hardware fault or that administrator can destroy both together, they are not an independent recovery copy.
4. Backup
A backup is a separate copy you can actually recover from. At least one useful copy should not be continuously writable from ordinary user accounts or from the live NAS. Otherwise ransomware, or a sync job faithfully copying a deletion, can reach it too.
5. Off-device and off-site copies
A copy in a second enclosure covers some hardware failures. A copy in another location covers theft, fire and local disaster. One catch: if that copy is encrypted and the key is lost, an intact backup is useless.
6. Access and remote access
Accounts, permissions, network boundaries and remote access decide who can reach the data. Encryption does not fix an account that has too much power and has been compromised.
7. Restore testing
Australian guidance says restoring important data, software and configuration should be tested in a coordinated way (ACSC regular-backup example). I treat a backup report that says "successful" as proof that a job ran, nothing more. It does not prove the right files come back in time.
What private storage helps with
- keeping selected sensitive files on equipment you control
- reducing day-to-day dependence on a public file-storage account
- serving files quickly across the local network
- applying your own retention, sharing and account rules
- keeping an exportable, documented copy of business knowledge, the same material a local AI and private document search would draw on
- running local applications such as Nextcloud where the maintenance load is justified
What this does not solve
A NAS does not stop an authorised user copying files somewhere else. It does not protect data shown on a compromised laptop, remove legal record-keeping duties or guarantee privacy from every application installed on it.
Sync is not backup. Sync tools are built to copy the current state everywhere; that can include deletions, corruption and files that ransomware has just encrypted. Version history may help, but check how long it is kept and whether the same administrator can wipe it.
Self-hosting does not remove suppliers either. Hardware firmware, domain registration, certificates, remote-access coordination, off-site backup storage and software updates may still involve vendors.
Design recovery before choosing hardware
Start with four questions:
- What data exists? Separate replaceable media (films you could download again) from irreplaceable personal records (the only copy of the family photos) and business-critical systems.
- How much loss is tolerable? A daily backup can lose up to a day of new work. Some systems need a shorter window; others do not.
- How long can recovery take? Restoring many terabytes over a slow link is a different job from restoring one deleted spreadsheet.
- Who owns the job? Name the person responsible for updates, failed backups, access reviews and recovery decisions.
Self-hosting checklists make this responsibility explicit: updates, security review, backups, disaster recovery and tests all need an owner (Bitwarden's self-host checklist). The same applies well beyond password managers.
A safe implementation path
1. Classify the data and users
List who owns each set of data, how sensitive it is, how long it must be kept and which people or devices need it. Do not put every household member, camera, scanner and business application into one all-powerful share.
2. Choose a maintained platform
Pick hardware and software with a security-update path, health monitoring and a way to export your data. Leave room for growth, for snapshots, and for rebuilding onto a replacement disk. Use supported combinations rather than assuming any disk, enclosure or app will work together.
3. Secure administration
Create named user accounts and keep administration separate from daily file access. Remove unused defaults and turn on multi-factor authentication where it is supported. Keep the management interface reachable only from trusted networks. Record the emergency access somewhere, but not on a label beside the device.
4. Configure snapshots as the first recovery layer
Use a retention pattern that keeps recent changes and older checkpoints without eating all the space. Test restoring a copy of one file. Do not let a working snapshot schedule replace the separate backup plan.
5. Build at least one separate backup path
Back up to removable media, a second system or a suitable service, with separate credentials and protection from routine writes. Add an off-site copy where fire, theft or losing the site matters. Watch for failed jobs and full disks; backups that quietly stop are common.
6. Back up the application, not only its visible files
For Nextcloud, the official guidance lists the configuration, custom apps, the data directory, themes and the database as parts of a complete backup (Nextcloud administration manual). The exact parts depend on the deployment. Other database-backed services need the same care: copying a folder while its database is still changing may give you a backup that will not restore.
7. Encrypt with a recovery plan
Use encryption where the risk calls for it, especially for portable or off-site media. Keep the keys or recovery material separately, limit who can reach them and test them. Encryption protects confidentiality; it does not make corrupted data healthy.
8. Keep remote access narrow
Do not expose every NAS or application service straight to the public internet by default. Internet-facing services carry extra security risk and need planned patching (UK NCSC).
A maintained VPN can provide a private path in. WireGuard is an encrypted tunnel, not an anonymity or content-filtering service (WireGuard). Tailscale uses WireGuard to carry and encrypt the traffic between your devices, while a hosted coordination service handles identity, keys and access policy, so that service remains a deliberate dependency (Tailscale). Choose and document the trade-off.
9. Patch and monitor
Apply security updates in planned windows. Watch disk health and free space, review accounts and look into backup failures promptly. Keep a current diagram and recovery runbook off the NAS.
Failure and recovery tests
I run these one at a time, with harmless test data, in a planned window:
- Single-file deletion: delete a test file and restore it from a snapshot without overwriting current work.
- Backup restore: restore a folder to a different location and compare file count, size and a sample of contents.
- Application restore: rebuild a test Nextcloud or other database-backed service from the documented backup set.
- Bulk-change scenario: alter or encrypt test files and prove that a protected copy predates the change and cannot be reached from an ordinary compromised account.
- Credential recovery: confirm an authorised person can get back in if an administrator loses a password or multi-factor device.
- Remote-device revocation: remove a test laptop or phone and confirm its remote credentials no longer work.
- Power recovery: after a controlled shutdown, confirm the system, shares, backup jobs and alerts all come back.
- Full-loss tabletop: without touching production equipment, walk through replacement hardware, configuration sources, encryption keys, data restore and telling the users. Record how long it took.
Do not pull a healthy disk or corrupt a live array just to "test RAID". Use the manufacturer's safe diagnostic and replacement procedure, and prove recovery on non-production equipment where you can.
When Alien IT can help
Alien Private Business may suit an organisation that wants private storage, controlled remote access, network segmentation (separate rooms for groups of devices), independent backups and a documented restore test with clear ownership of the maintenance.
It is not a compliance certification, a guarantee against data loss or a set-and-forget box. Some homes and businesses are better served by a reputable managed cloud service plus an independent backup. We assess sensitivity, capacity, recovery needs and who will operate the system before recommending self-hosting.
If you only want the backup side done for you, see backup and disaster recovery.
Not sure whether a NAS, a managed cloud service or a plain external drive is right for your files? Call 02 9707 0999 or use the contact page.
Frequently asked questions
Is RAID a backup?
No. RAID can keep a system available through some disk failures. It does not independently protect against deletion, ransomware, theft, fire or a damaged array.
Are snapshots backups?
Snapshots are a useful recovery layer. If they live in the same box under the same administrator as the data, keep a separate protected copy as well.
Should I open my NAS to the internet?
Usually not directly. Prefer a maintained remote-access design with strong identity controls. If a service must be public, treat it as an internet-facing system with active patching and monitoring.
Is self-hosting always more private than cloud storage?
No. It changes who holds the files. Poor permissions, exposed services or failed backups can outweigh that benefit. A well-governed cloud service may be safer for some users.