When you run a branded backup service, one of the decisions you own is where your clients’ offsite copies land. AWS S3 is one of those choices. Most articles about AWS cloud backups are written for the business buying storage for itself. This one is for the IT shop deciding whether to put its clients’ backups on S3, and how that fits into a service you sell under your own name.
Where AWS fits in a service you run
In a white-label backup model, storage is a component you pick, not the whole product. Your branded agent backs up the client machine; the encrypted offsite copy lands in a bucket you control. That bucket can be an S3 bucket in a US region. You connect it once and pay AWS directly, so there is no storage markup between you and Amazon, and whatever you charge the client above your storage cost is yours to keep.
That is the important distinction on a page like this: your client is not buying AWS. You are, on their behalf, as the plumbing behind the service they see with your name on it.
What S3 gives you as the offsite target
S3 is a strong fit for the offsite tier of the default architecture: branded agent on the machine, a local vault on an endpoint, USB, or the client’s NAS for fast file pulls, and the cloud copy in S3 for the disaster case.
US regions can help address certain data-location requirements, while compliance also depends on the overall configuration, contractual requirements, and applicable regulations. Backups can be encrypted in transit and protected at rest in S3, depending on the backup software and storage configuration.
Mind the cost model
S3 is pay-as-you-go, and that cuts both ways. You pay for storage by class, plus data transfer and retrieval. For backup, which mostly writes and rarely reads, that can be efficient. But the day a client’s data is encrypted and you pull a full restore is the day retrieval and egress charges show up, and colder storage classes that are cheap to hold are slower and costlier to pull from in a hurry. Price that into the client’s plan so a large restore does not surprise you.
If a client restores often, or you simply want a flat monthly storage number you can quote without doing math, flat-rate providers like Wasabi or Backblaze B2 often pencil out better. The platform lets you choose per client, so you can run S3 where its regions and integration matter and a flat-rate bucket where predictability matters. Match the bucket to the client rather than forcing every client onto one.
Running it day to day
Whichever bucket a given client uses, every endpoint you protect shows up in one Backup Ops console. You catch missed jobs each morning, pull reports, and push config remotely without a site visit. Server clients get SQL and Exchange jobs, full disk images, and bare-metal restore as standard, not add-on SKUs, and a server endpoint bills the same as a workstation. The storage choice is under the hood; your workflow stays the same across your whole book.
Prove the restore before you need it
-
Test a real restore from the bucket. Pull a file and rebuild a machine from an image, and note how long a restore actually takes from the storage class you chose, especially if you used a cold tier.
-
Set retention deliberately. Define how long each client’s versions are kept so you meet their retention or compliance needs without paying to store data no one will ever restore.
-
Keep versions from before an infection. Point-in-time copies offsite are what let you roll a client back past the moment ransomware hit.
-
Match the policy to the asset. A file server gets image plus file jobs; a database server gets SQL jobs. Do not run one blanket policy across everything.
-
Watch it in one place. The point of a single console is that a missed job on any client surfaces in the same morning check you already do.
Bottom line
AWS cloud backup, in a partner’s hands, is not a product your client buys from Amazon. It is S3 serving as the offsite tier behind the branded service you run. Choose S3 when its regions, durability, and integration fit the client, and choose a flat-rate bucket when a predictable bill matters more. Either way you keep the brand, the console, and the margin. And if you would rather hold the vault on your own hardware than any cloud bucket, WholesaleBackup Server runs on a Windows box, though most partners run cloud offsite plus a local vault.
