The 'Free' Backup Stack Isn't Free: A Three-Scenario Cost Audit for Small IT Shops
Every small IT shop has had this conversation. Someone points at the subscription line item, someone else says restic is free, and the room nods because the software license genuinely is free. Then six months pass and the same two people are the only ones who know how the cron job works.
This is not an argument against open-source backup. It is an argument for pricing the parts that never show up on a quote.
The four contenders, on paper
| Tool | License | Sweet spot |
|---|---|---|
| restic | BSD-2-Clause | Cloud-native, encrypted, dedupe, single binary |
| Borg | BSD-3-Clause | Local and SSH targets, excellent dedupe, mature |
| Duplicati | MIT | GUI-driven, broad destination support |
| UrBackup | AGPL-3.0 | Bare-metal image backups, Windows-heavy fleets |
Not one of them charges you a dime. All four move the cost from a credit card to a calendar, and calendars are more expensive than people think.
Five costs that hide under the word free
1. Egress, which nobody models until the first full restore
Storage prices are the visible part. Backblaze B2 runs about $6 per terabyte per month in 2026 with free egress up to three times your average stored volume; past that it is roughly a penny a gigabyte. Amazon S3 Standard is around $23.55 per terabyte monthly, and egress is about nine cents a gigabyte. Wasabi sits near $6.99 per terabyte with no egress charges but a 90-day minimum retention.
Pull a full 3TB restore out of S3 in a single afternoon and you have spent somewhere near $270 on network transfer alone. That is a cost you discover during an incident, which is the worst possible time to discover a cost.
2. Scripting and monitoring overhead
restic and Borg do not schedule themselves, do not alert you, and do not retry politely when a snapshot fails at 2 a.m. You build that. Across the shops we talked to, initial glue work ran 12 to 20 hours, with 1 to 3 hours a month of babysitting afterward. It is genuinely enjoyable work for the right person and a slow leak for everyone else.
3. The support gap
There is no one to call. Forums are good, and the UrBackup community in particular is unusually responsive, but a forum thread is not an SLA. The moment you need a vendor to stand behind a restore during an outage, the free stack's advantage evaporates.
4. Storage sprawl
Retention policies written in a wiki and never enforced become an append-only archive of every file the company ever created. Backup repositories grow 8 to 12 percent a year by default at most small shops, and you pay that growth out monthly, forever.
5. The restore you did not test
This one is not a line item until it is. An untested backup repository is a hypothesis. Drills cost staff hours, and with restic and Borg you also carry a hard dependency on the repository password: lose it and the data is mathematically unrecoverable, no ticket required.
Three scenarios, priced out
Assumptions: $75 per hour fully loaded labor, 2026 list storage prices, three-year horizon, no hardware refresh. These are estimates for comparison, not quotes.
| Scenario | Data | Primary target | Storage, 3 yr | Labor | 3-yr total |
|---|---|---|---|---|---|
| A: 5-person office, cloud-only | 1.5 TB | Backblaze B2 | $324 | ~$5,400 | ~$5,700 |
| B: 20-person shop, cloud-first | 6 TB | S3 Standard | ~$1,700 + ~$1,300 egress | ~$11,000 | ~$14,000 |
| C: 10-person hybrid, retention rules | 3 TB | NAS + B2 mirror | ~$1,470 | ~$7,650 | ~$9,100 |
The pattern is blunt. Storage is the cheap part. Labor is 80 to 90 percent of the total in every scenario we modeled, and scenario B pays an extra grand just for not thinking about egress math.
Compare that to a managed backup service for a shop of that size, and the free stack often still wins — but by hundreds of dollars, not thousands. That is a very different sales pitch than the one people usually make.
Where open source genuinely wins
- You already have an admin with slack in their week.
- Your data is large and mostly static, where dedupe pays for itself.
- You cannot hand custody of encryption keys to a vendor.
- The software budget is zero and the labor budget is already sunk.
Where it loses badly
- One or two IT people with no slack and no documentation culture.
- High-churn data with frequent restore requests, where egress eats the savings.
- Anyone who needs a contract, an SLA, or a named human on the phone.
The audit checklist
Before you standardize on a free tool, run through this and write the answers down:
- Measure actual full size and daily change rate, not the folder size someone quoted in a meeting.
- Price a full restore from your chosen target, not a single-file restore.
- Multiply your setup estimate by 1.5, then add monitoring and alerting.
- Schedule a timed restore drill quarterly and put it on the calendar with an owner.
- Escrow the repository key in two places with two names attached.
- Write the retention policy with dates and an enforcement mechanism, not good intentions.
- Add a dead-man's switch alert so a silently broken job is loud.
- Compare against a paid option at your real terabytes, not the 5GB trial.
- Read the license, especially AGPL, so you know what free actually covers.
- Total the labor hours at a real rate. That is your true cost of ownership.
The bottom line
Keep using restic and Borg. They are excellent, auditable, and genuinely yours. But stop describing them as free in budget meetings, because the number you are actually defending is labor plus egress plus the probability that nobody tested the restore.
Free is a fine place to start a backup plan. It is a terrible place to finish one.
