Inside the portal
Connection details, snapshots, and device management in one place.
Everything you need to connect Restic and monitor your backups. No support tickets, no console trails.
ServerCrate gives you a private Restic over SFTP backup target with encrypted offsite storage, no egress fees, and a workflow that is easy to understand. Built for Linux servers, homelabs, Docker hosts, and serious file backups.
Use the free tier to validate your workflow first, then move up when storage or device count becomes the limit.
A lot of backup products bury the actual workflow behind vague "cloud backup" language. ServerCrate is straightforward: you get a private vault, connect Restic over SFTP, run your backups, and restore without paying egress penalties.
Most managed backup services give you two bad choices: a proprietary agent that only talks to their cloud, or raw object storage that you have to assemble tooling around yourself. Restic over SFTP skips both traps.
Every chunk is AES-256 encrypted with a key that only exists on your device. The vault sees encrypted ciphertext - no metadata, no filenames, no file sizes that would leak intelligence about your data. Even with full root access to the server, we can see that you have data, but not what it is.
No agent to install, no daemon to keep updated, no proprietary protocol to audit. If OpenSSH works on your box (it does, or you have bigger problems), SFTP works. The transport is mature, well-audited, and supports standard SSH key authentication.
Your Restic repo is a filesystem of opaque encrypted files. If you ever want to migrate to self-hosted, rsync.net, or a different backup host, you copy the files and point Restic at the new location. No export tools required. The repo format is documented and stable since 2017.
Numbers from backing up a mixed-workload server over a residential 1 Gbps uplink to a ServerCrate vault. Your results depend heavily on the file mix, your upload speed, and how much data has changed.
Upload speed is almost always the bottleneck on the first run. A 50 Mbps residential uplink will push about 5-6 MB/s, so 500 GB takes ~28 hours. Plan the first run over a weekend.
File mix matters for incremental runs. A dataset with lots of small files (Docker volumes with SQLite databases, for example) spends more time on metadata than throughput. Large VM exports that change in narrow byte ranges dedup beautifully.
Cold cache effects show up on restore. The first restore from a new session pulls index metadata first. After that, restore is as fast as your downlink.
Everything you need to connect Restic and monitor your backups. No support tickets, no console trails.
Transparency on the infrastructure, because people asking about backup hosting deserve to know what they're trusting.
Vaults live in LXC containers running on a Proxmox host with ZFS as the underlying filesystem. ZFS checksums every read and write - silent data corruption gets caught and repaired against a mirror, not blindly handed back to Restic. That matters for backups: a repo you can't actually restore from is worse than no backup at all.
Each customer gets a dedicated ZFS dataset with quota enforcement. Your data is physically separated from every other tenant's data. Not namespace isolation - separate datasets.
The public-facing endpoint vault.servercrate.net terminates at an edge router that forwards SSH/SFTP traffic over a WireGuard tunnel into the private network where the vault containers actually run. This keeps the attack surface minimal - the vault containers themselves aren't exposed to the public internet, only SFTP and only through a per-port mapping.
The edge router runs nftables with default-deny. SSH/SFTP attempts that fail are tracked by fail2ban with short bans for probes and long bans for persistent attackers. Above that, CrowdSec pulls a shared community blocklist - at any given moment the edge is blocking 15,000+ IPs that have been seen attacking anyone else running CrowdSec. Your vault port only sees traffic from your known devices.
Restic's repository format wraps every backup chunk in AES-256-CTR with a Poly1305-AES MAC. The key is derived from your repository password via scrypt. That password lives only on your device - we store a hash of it in our database for provisioning, never the password itself.
Server-side we see a directory full of opaque data/xx/yyyyyy... files. Not filenames, not sizes that correlate to real files, not timing patterns that leak operational intel. Full zero-knowledge as a mathematical property, not a marketing claim.
If you've been researching this space, you've probably already looked at these. Here's the practical tradeoff.
| ServerCrate | rsync.net | BorgBase | Self-host SFTP | |
|---|---|---|---|---|
| Restic support | First-class | Supported | Borg + Restic | Yes |
| Entry price | $5/mo (200 GB) | $24/yr (100 GB)Cheaper annually | $16.80/yr (250 GB)Borg-first | VPS + time cost |
| Free tier | 10 GB, no card | None | 10 GB free forever | N/A |
| Dedicated storage | ZFS dataset per user | Shared ZFS pool | Shared pool | Whatever you build |
| Monitoring & alerts | Portal + email | Manual | Built-in alerts | Roll your own |
| Zero-knowledge | Client-side | Client-side | Client-side | You control the key |
| Egress fees | None | None | None | None if you're DIY |
| Time to first backup | 5 minutes | 15-30 min (SSH key setup) | 15-30 min | Hours to days |
| Best for | Managed Restic, one page | Long-tenure admins | Borg purists | Full control, time to burn |
For deep side-by-side analysis: Restic vs Borg vs Tarsnap vs Arq vs Duplicacy vs BorgBase vs rsync.net.
This is built for people who want clear offsite backup, not a messy pricing model or proprietary nonsense.
Restic is the recommended client and what we tune the platform around. The vault itself is a standard SFTP endpoint though, so anything that speaks the protocol can read or write to it. That matters for two reasons: you can verify Restic uploads landed by browsing the vault with FileZilla, and you have a fallback if you ever need raw access to the encrypted blobs.
sftp backend with md5sum_command=none.sftp(1) + lftp + curlBorgBackup is the one major exception - it requires SSH shell access we don't ship by design. If you need Borg, BorgBase is the right home for it.
The strongest signal we can give you is to tell you when we are the wrong fit. Short and honest.
This page explains the product fit. These pages help with the next step.
Private vaults. Zero-knowledge design. No egress fees.
Built for clean offsite backup workflows.
Restic-friendly, no egress fees, cancel anytime
Bitcoin-friendly: We accept on-chain BTC and Lightning via self-hosted BTCPay. See Restic backup paid with Bitcoin for the full breakdown.
10 GB. No credit card. Setup in 5 minutes. Bitcoin or card when you upgrade.
Start free vault →