VPS

What it means

A VPS, or virtual private server, is a dedicated slice of a powerful physical server that a company rents from a provider. Through virtualisation it has its own operating system and allocated CPU, memory and disk, and is managed like a standalone server, even though it physically shares hardware with other customers.

A VPS sits between shared hosting, where many websites share one environment with no access to the system, and a dedicated physical server. It is cheaper than owning a server and offers more control than shared hosting, but compared with fully managed cloud services it requires more self-administration.

Companies use a VPS for high-traffic websites and online shops, internal applications, databases, remote access to accounting software or test environments. The provider is responsible for hardware and network, while the customer is usually responsible for the operating system, applications and data.

How it works in practice

For clients running their own applications on a VPS, we check who is responsible for updates and security. It often turns out that an external developer set up the server years ago and nobody has updated it since. Regular patch management on a VPS is the customer’s job.

Backups are essential. Some providers offer server snapshots, but these are often stored in the same place. We recommend keeping at least one backup outside the provider and regularly testing restores so that RPO and RTO targets can be met.

If personal data are processed on the VPS, the provider is a processor and the company needs a data processing agreement with it. The data centre location should also be checked, especially with providers outside the EU.

What to watch out for

The most common mistake is assuming a VPS is “in the cloud” and so someone else takes care of security. An unmanaged VPS is exposed to the internet, and without updates, a firewall and strong authentication it quickly becomes a target.

Dependence on one person is another risk. If only an external contractor holds the access credentials and knows how the server is set up, the company can neither manage nor migrate it when they leave. Credentials and configuration documentation should be kept within the company.