Cloud backup solutions look cheap until a client needs the data back. The storage line is predictable and the retrieval line is not, which is how an MSP ends up absorbing a restore bill it never quoted for. This guide works through the real cost structure of backup storage for a South African managed service provider, where the data-residency question genuinely bites, and how to build a margin that survives a client’s worst week.
What makes cloud backup solutions hard to quote?
Cloud backup solutions have two price lines and only one of them is predictable. Capacity is easy: you know roughly how many terabytes a client holds and how fast that grows. Retrieval is the problem, because nobody knows in advance how much data they will pull back or when.
Traditional hyperscaler object storage charges separately for egress and for API requests. Under normal conditions that is a rounding error. During a restore it is not. A client recovering 8TB after a ransomware event generates 8TB of egress in a few days, and that bill arrives in the same month as the incident.
For an MSP selling a fixed monthly backup fee, this is a margin risk sitting quietly inside the contract. You priced for storage. You got billed for a disaster.
How does flat-rate storage change the model?
Flat-rate storage removes the variable line entirely. Wasabi Hot Cloud Storage charges for capacity only, with published pay-as-you-go pricing at $7.99 per TB per month, and states plainly that there are “no fees for egress or API requests”. Wasabi Cloud NAS sits at $8.99 per TB per month. Wasabi Reserved Capacity Storage plans run on one, three or five year terms.
That predictability is the actual product. An MSP can quote a per-terabyte rate to a client and know the cost base will not move when something goes wrong. The detail for partners is on our Wasabi cloud storage for MSPs page.
There is a condition worth reading properly. Wasabi’s free egress policy applies when monthly egress is less than or equal to the volume of data stored. Their own wording: “If your monthly egress data transfer is less than or equal to your active storage volume, then your storage use case is a good fit for Wasabi’s free egress policy.” Backup and archive fit that shape comfortably, because you write far more than you read. A content delivery workload does not.
Minimum storage duration also differs by plan. Pay-as-you-go carries a 90 day minimum. Reserved Capacity Storage carries 30 days. If you are churning short-lived data, model that before you quote.
Does the data have to stay in South Africa?
POPIA does not require personal information to stay inside South Africa. Section 72 of POPIA permits transfer across borders where certain conditions are met, most commonly where the recipient is bound by rules or a contract providing an adequate level of protection comparable to POPIA’s own conditions.
This matters because it is widely misunderstood, and because it decides which vendors you can put in front of a client. Wasabi operates 16 storage regions across North America, EMEA and Asia Pacific. There is no Johannesburg or Cape Town region. For a South African MSP the practical choice is an EMEA region, with the latency and contractual questions that follow.
Be straight with clients about that. Some workloads genuinely need local residency for latency or for a sector rule rather than for POPIA itself, and in those cases a different architecture applies. Selling an offshore region as if it were local is the kind of thing that surfaces during an incident, at the worst possible moment.
If you are working through a client’s data protection obligations properly, our guide to cyber security for South African businesses covers the wider control set. You can also talk to our team about partner enablement if you want the vendor comparison done against your actual client base.
What does immutability actually do for a backup?
Immutability stops anyone deleting or altering a backup copy for a defined period, including an administrator whose credentials have been stolen. Object Lock is the mechanism, and it is the single control that separates a backup that survives ransomware from one that does not.
Wasabi describes Object Lock as allowing customers “to designate certain objects to be immutable, meaning they cannot be altered or deleted by any application or user during a fixed date range defined by the user”. The important phrase is “any user”. Modern ransomware operators look for the backup system first and delete what they find. An unlocked backup repository reachable with domain credentials is not a recovery plan.
Arcserve UDP 11, released in June 2026, supports S3 Object Lock in both Governance and Compliance modes, and added virtual machine deployment of Cloud Cyber Resilient Storage with the same immutable snapshot capability. Governance mode allows a privileged user to override the lock. Compliance mode does not. Choose deliberately, because the difference is the whole point of the control.
Which backup workloads do MSPs forget to cover?
Microsoft 365 is the gap. Microsoft operates a shared responsibility model: they keep the service running, the customer remains responsible for their own data. Retention policies and recycle bins are not backup, and clients routinely assume otherwise.
Arcserve SaaS Backup covers a wider surface than most MSPs quote for. Microsoft 365 including Exchange Online, OneDrive, Teams and Groups, SharePoint and Public Folders. Microsoft Entra ID. Dynamics 365, Power BI and Azure DevOps. Salesforce and Google Workspace. Jira Cloud, Confluence Cloud and Zendesk.
Barracuda Cloud-to-Cloud Backup is the other option in the portfolio for Microsoft 365. It protects Teams, Groups, Exchange, SharePoint, OneDrive, Planner and OneNote, as well as Entra ID data, and holds the copies in immutable storage that can only be changed through Barracuda’s own interface. It is the natural add-on for a partner already selling Barracuda email protection, and our cloud-to-cloud backup page sets out the options.
Every one of those is a place client data lives and a place a departing administrator can do damage. Quoting only for servers leaves most of a modern business unprotected.
WANT THE BACKUP ECONOMICS RUN AGAINST YOUR OWN CLIENT BASE?
We work through the capacity, egress and residency questions with partners before they quote, not after.
Start my partner enquiry
How should an MSP price a backup service?
Price on capacity and hold the retrieval risk at zero by choosing a storage layer that does not charge for it. That is the whole argument for flat-rate storage in a managed service: it makes the cost base match the billing model.
Three things are worth building into the quote from the start. Charge for the restore test, not just the backup, because a backup nobody has tested is a liability you are carrying for free. Separate the SaaS workloads into their own line so the client sees what Microsoft 365 protection costs rather than absorbing it invisibly. Set the immutability window to match the client’s realistic detection time, which for most South African businesses is considerably longer than they expect.
On that last point, SonicWall’s 2026 Cyber Protect Report puts average breach detection at 181 days. A 30 day immutability window does not survive a dwell time like that.
What should you check before committing to a vendor?
Check the minimum storage duration against your client’s data lifecycle, because a 90 day minimum on short-lived data is a real cost. Check which regions are available and what that means for latency on a large restore. Check whether immutability runs in Governance or Compliance mode and who can override it. Check what the SaaS backup licence actually covers, because the platform list varies more than the marketing suggests.
Then test a restore. Not a file. A full system, timed, in front of the client if they will sit through it. The number that matters is how long it takes to get a business running again, and that number is never the one in the datasheet.
BUILDING A BACKUP PRACTICE ON SOLID ECONOMICS?
Loophold distributes Wasabi, Arcserve and Barracuda to South African partners, with the enablement to size and price them properly.
Become a Loophold partner
