Nextcloud: your own cloud for files – what it is, who it is for and what you have to maintain in it

WebDisk Blog · category: Cloud services · reading time: ~9 minutes

In short:- Nextcloud is an open platform for working with files and collaborating – a network drive, a calendar and contacts in one place, available from a browser, from a desktop application and from a phone.- Companies choose it not because it is "better than OneDrive", but because it gives them control: open source code, a known data location and the ability to move that data out at any moment.- Nextcloud will not maintain itself. Updates, backups, performance and certificates are ongoing work – and it is that work which decides whether self-hosting or a managed option makes more sense.

Most companies arrive at Nextcloud by the same route. First the files sit on the drive in the accountant's computer. Then somebody creates an account on a free cloud drive, because some scans had to be sent quickly. Two years later the company's documents are scattered across three private accounts, a NAS sitting next to the photocopier and the CEO's mailbox. The question "where exactly is our data and who is responsible if we lose it?" is usually asked at the worst possible moment – during an audit, when an employee leaves or after an outage.

Nextcloud is one of the sensible answers to that question, but it is not a free answer, nor a maintenance-free one – and that is exactly what this article is about. We explain what Nextcloud really is, who it makes sense for, what work you take on together with it and why for many companies the managed option turns out to be the more reasonable choice.

The text is aimed at the people who choose the tools in a small or medium-sized company – we do not assume administrative knowledge, but we do not hide the technical costs either.

What is Nextcloud and what can it do beyond files?

Nextcloud is sometimes described as "your own Dropbox" and that shorthand is misleading, because it understates the scope. Yes, files are the foundation: folders, sharing by link, permissions, document versioning and a trash bin that catches whatever someone deleted too quickly. But the same account also runs a calendar and contacts (in the open CalDAV and CardDAV standards, so they plug into ordinary phone applications) as well as a catalogue of add-ons: notes, tasks, a messenger, forms. Nextcloud also lets you install an office suite for editing documents in the browser.

Access comes in three forms and in practice that matters more than the feature list:

• browser – nothing needs to be installed, it works from any computer;
• synchronisation client for Windows, macOS and Linux – it creates an ordinary folder on the disk whose contents are mirrored in the cloud; the user works as if on a local drive and does not have to know that anything is being synchronised;
• mobile application for Android and iOS – with automatic photo upload, thanks to which material from the field reaches the company drive by itself.

Nextcloud's code is open (AGPLv3 licence) and developed by Nextcloud GmbH together with a large community, and deployments range from home servers to public institutions. For a company this means a concrete safeguard: even if the service provider were to disappear, the software and the data format remain available. That is what the talk of not depending on a single vendor actually amounts to – we wrote about it in more detail in the article on vendor lock-in.

Who does Nextcloud make sense for?

Nextcloud solves three problems at once and it is worth checking whether these are your problems.

Control over where the data sits. In a company that processes clients' personal data or works on documentation subject to regulation, the question about location and the processing entity is not theoretical. Your own instance – whether on your own hardware or at a provider with a clearly indicated location – lets you answer that question in a single sentence. We went deeper into data sovereignty in the article on European cloud computing.

One reservation: special categories of data (including health data) and data covered by separate regimes, such as PCI-DSS, are accepted only after prior arrangements – as stated in the service terms. If your documentation falls into those categories, start with a conversation with us, not with a purchase.

Order instead of scattered accounts. One place, one list of users, one set of permissions. An employee leaving stops being an archaeological dig.

Independence. Open protocols (WebDAV, CalDAV, CardDAV) mean that leaving the service is a matter of copying data, not of negotiation.

What Nextcloud is not, however, is a replacement for a full office suite with mail, advanced analytics and an entire layer of corporate integrations. If a company runs on Excel with macros and on Teams embedded in every process, the honest answer is: Nextcloud will cover files and document collaboration, but it will not recreate the whole ecosystem one to one.

What do you really take on when self-hosting Nextcloud?

Nextcloud can be downloaded for free and run on your own server – and that is true, though it can be misleading, because the licence is the smallest component of the cost. A running instance requires constant care:

• Updates. New releases appear regularly, and older branches stop being supported by the vendor. Updates cannot be "skipped" by several versions – they are done one after another, checking along the way that the installed add-ons are compatible.
• Backups that somebody has restored. A Nextcloud backup is three things at once: files, the database and the configuration. A database copy inconsistent with the file copy can look correct right up to the day of the restore. More about the rules that apply here in the article on cloud backup.
• Performance. With several hundred thousand files and a dozen or so users, tuning begins: the database, the cache, limits, preview indexing. The symptom is usually "Nextcloud has become slow", and the cause – the configuration, not the software.
• Certificate and domain. A TLS certificate expires and has to be renewed automatically; an expired one can stop the work of the whole company on a Wednesday at nine in the morning.
• Security and availability. System updates, access control, multi-factor authentication, monitoring – plus the answer to the question of who reacts when the server stops responding on a Friday evening.

All of this is doable. It does, however, require a person who knows how, has the time for it and will still be with the company in two years. The absence of that person is the most common reason why a company's Nextcloud sits, after a year, on a version without vendor support, with a backup nobody has ever restored.

What does managed Nextcloud give you, and what stays on your side?

In the managed option you get a working instance, and the layer underneath it – the server, the operating system, platform updates, certificates and instance snapshots – is on the provider's side. We monitor the infrastructure; monitoring of the instance itself (availability and performance) is an option you enable in the panel. What is left to you is what nobody would do for you anyway: users, permissions, the sharing policy and the decision about what lands in that cloud.

That is how WebDisk Next works – our managed Nextcloud service. Among the things worth knowing before a conversation about deployment:

• Every client gets their own virtual machine with their own instance – not an account on a shared installation. That is why we describe the plans with environment parameters (vCPU, RAM, SSD space) rather than with the number of "gigs on the account" alone: isolation and performance matter in day-to-day work just as much as capacity.
• Space can be extended with additional terabytes on HDD drives, paid monthly per capacity. Current plan parameters and prices are on the service page – WebDisk Next.
• We take instance snapshots on a rotating basis, in line with the plan parameters – they exist to restore the instance after a failure and do not replace your own backup. That is why in the terms of service we recommend keeping your own copy of critical data outside the service, following the 3-2-1 rule.
• The data – the virtual machine, its disks and snapshots – stays on our infrastructure in Poland and does not leave the European Economic Area; we have put that in the service terms and in the data processing agreement (DPA). The terms, the SLA and the DPA are documents your data protection officer will ask about sooner or later.
• The instance runs under an individual subdomain in our domain, with a TLS certificate renewed automatically – you do not need to have your own domain or keep an eye on it. After the subscription ends, the subdomain returns to the pool.
• Synchronisation covers Windows, macOS, Linux, Android and iOS.

What the managed option does not mean: we do not promise someone sitting by the phone around the clock. What we do commit to is service availability at the level written into the SLA (99.95% per year), maintenance windows at night announced in advance and tickets through the panel.

If you are wondering where this service sits on the IaaS–PaaS–SaaS axis: it is a model close to SaaS with retained control over the data – the distinctions are laid out in the article cloud as a service.

Nextcloud or object storage – which for working files, which for an archive?

Nextcloud is good at day-to-day work: someone edits, someone shares, someone looks for an invoice from last month. It is not, however, the cheapest place for a multi-year archive of recordings, virtual machine images or copies from backup systems. That is what S3 object storage is for, addressed over an API – billed for the capacity actually used, with a transfer package in the subscription and a surcharge for transfer above the package, which is worth calculating especially with restores in mind, not storage alone. With us this is the Object Storage service, compatible with the S3 API; we described it in the article Object Storage in WebDisk.

The split is therefore natural: Nextcloud for what is alive and being edited, object storage for what is meant to sit for a long time, cheaply and untouched. Do you have a NAS or a surveillance recorder and want a copy of them outside the office? If the device can write to S3 – and most newer NAS units and backup tools can – our Object Storage is enough. If it cannot, write to us: we will check whether it can be handled.

An honest reckoning

• "Unlimited capacity" does not exist. What exists is capacity you can buy more of – and it is worth calculating its cost over a year instead of believing slogans.
• Synchronisation is not a backup. A file deleted or encrypted by ransomware on the user's computer will synchronise to the cloud just as smoothly as any other change. The trash bin and versioning help, but a resilient archive is a separate layer – we write about immutable copy mechanisms (WORM) in the article on S3 Object Lock.
• A snapshot is not a backup. A snapshot restores the instance from a given moment; it does not protect against a deletion you fail to notice for several weeks.
• Encryption at rest is something you enable yourself. Connections are encrypted with TLS, but the instance's storage media and snapshots are not encrypted at rest – if your data requires it, enable server-side encryption within Nextcloud itself. We have written that explicitly into the data processing agreement instead of promising "full security".
• Add-ons are yours. Applications installed from the Nextcloud catalogue are installed at your own responsibility – a major version update can disable them and nobody will guarantee that they survive. The more add-ons, the more work with every large update, regardless of the option chosen.
• The managed option does not remove responsibility for content. Who has access to which folders and what may be shared externally – that is always the client's decision.
• Migration costs time. Moving a company to a new file platform is always a project and a period of getting used to it – regardless of the provider.

Frequently asked questions

Is Nextcloud free? The software yes – it is open and there are no licence fees. You pay for what it runs on and for the work around it: the server, updates, backups, somebody's time. In the managed option most of those costs are explicit and predictable – apart from your own copy of the most important data, which stays on your side.

Does my data really stay mine? Yes – and that is verifiable. Nextcloud makes data available over WebDAV, and the synchronisation client keeps a copy of it in an ordinary folder on the disk. You can test leaving the service any day you like, without asking anyone's permission.

Nextcloud, Microsoft 365 or Google Workspace? It depends on what the constraint is. If you need a full office ecosystem with mail and deep tool integration – the hyperscalers' suites are strong at that. If control over data location, an open format and independence from a single provider are what counts – Nextcloud wins. Both models can also coexist.

I have a NAS. Will Nextcloud replace it? It can replace it or complement it. A NAS sitting in the same building as the company shares all of its risks: flooding, fire, theft, ransomware on the local network. An off-site copy is a value in itself – and that is usually where it starts.

How many people can use one instance? That depends on the virtual machine's parameters and on how intensively you work with files – which is why, when choosing a plan, it is best to give the number of users and the expected data volume.

Does synchronisation to the cloud replace a backup? No. A file deleted or encrypted by ransomware on the user's computer will reach the cloud just as smoothly as any other change, and an instance snapshot only restores the state from a given moment – it will not protect against a deletion noticed weeks later. The trash bin and versioning help, but a resilient archive is a separate layer; that is why we recommend keeping your own copy of critical data outside the service, following the 3-2-1 rule.

Where is the data stored in the managed Nextcloud service WebDisk Next? On our infrastructure in Poland. The virtual machine, its disks and snapshots do not leave the European Economic Area, and that commitment is written into the service terms and the data processing agreement (DPA) – the documents your data protection officer usually asks about.

Summary

Nextcloud gives a company its own cloud for files with collaboration, a calendar and contacts, with open source code and a known data location. The price of that independence is not written into the licence, but into maintenance: updates, backups and performance. The managed option moves part of that work to the provider – the server, the platform, certificates, snapshots – and leaves you with two things: the decision about who has access to what, and your own copy of what matters most.

Would you like to check whether this solution fits your company? Take a look at WebDisk Next or write to us – we will help you choose the instance size and plan the data migration.