What is client-side encryption for backups, and do I need it on a rented server?

Why does a rented server need client-side encryption?

A server you rent is a machine other people can touch. Drives fail and get replaced: When a drive fails, open a ticket: the team has it replaced at no cost, and rebuilding the array on the new drive is up to your setup. Drives get wiped when a rental ends: Each server is paid in advance from your crypto balance, for 30 days, 3 months, 6 months or 12 months as chosen at checkout. Auto-renew charges the same length again at the price you started with, unless you set another length for the next renewal in the dashboard; when the balance falls short, the server stops at the end of its term, its drives are held for 7 days and then wiped. And anyone who breaks into the running server reads whatever it holds in clear.

With client-side encryption, none of those events exposes your data. The server stores ciphertext, and the key stays on the machines you back up.

Encrypt where the data is born, and the server only ever stores noise.

How is it different from disk encryption or server-side encryption?

Three layers get called encryption, and they protect against different things.

• Disk encryption on the server (LUKS or ZFS native encryption) protects drives at rest. Nextcloud's documentation suggests LUKS for local storage, because it also covers theft of the physical server. It does nothing once the server runs with the key loaded. You can encrypt every data drive with LUKS or ZFS native encryption; the keys stay with you and nobody on the team ever asks for them.
• Server-side encryption in an application, such as Nextcloud's, keeps the keys on the server. Nextcloud says it does not protect against a compromised server or a malicious administrator.
• Client-side encryption happens before upload. The server never holds the key, so a compromised server still sees only ciphertext.

Use the first and the third together. Disk encryption needs an unlock at every boot; unlocking a LUKS-encrypted rented server remotely shows how.

How does each tool handle the key?

The key is the backup. Lose it, and the encrypted copy is worthless to you too.

• restic: your password opens the master key. Without it, nothing in the repository can be read.
• Borg: run borg key export and keep the result away from the backed-up system. Borg's docs say a copy on that system is not enough for keyfile mode.
• Proxmox Backup Server: the key file defaults to ~/.config/proxmox-backup/encryption-key.json. A master key pair puts an RSA-encrypted copy in every backup, and paperkey prints the master key as a QR code. Since 4.2, push sync jobs can encrypt snapshots before sending them.
• Hyper Backup: Synology warns it cannot recover a lost password, and losing it means permanent data loss.
• Veeam: a lost password blocks restores, unless Enterprise Manager keys were used.
• ZFS replication: zfs send --raw sends encrypted datasets as they are on disk. OpenZFS says the receiving machine never has the keys.

The two most common tools are compared on restic or Borg for offsite backups.

What does client-side encryption not hide?

It hides contents and, for most tools, names. It does not hide how much you store or when. restic's own design notes say an observer with access to the storage can infer backup sizes from object timestamps. Its key files also keep the hostname, username and creation time in plain text.

Applications that work on your files, such as Nextcloud or Immich, need them in clear on the server to index, preview and search. For those, use disk encryption on the server, and client-side encryption for their offsite backups. Encryption also does not stop deletion: pair it with immutable backups.

Do I still need encryption if the host asks for no ID and keeps no logs?

Yes, because they answer different questions. No KYC covers who you are; encryption covers what you store.

Of 23 storage-server sellers Basalthold checked on 2 November 2026, only 3 state that they ask no ID. Of the rest, 12 ask on triggers, 2 before delivery, and 6 do not say. On our side: No KYC: no ID, no selfie, no documents, no card and no phone number, at any point. No logs are kept: no connection records, no traffic records and no visitor or customer IP addresses, on the website, in the dashboard or on the servers.

Neither rule changes what a drive holds when it leaves the machine. What happens to drives after a rental ends is on your data after you cancel a rented storage server. Prices are on the hold price list.