info@intercolo.net +49 (0)69 564060 Frankfurt am Main
Đăng nhập Đăng ký
S3-compatible · SOBR Capacity Tier

Veeam Backup Target in Frankfurt

Plugs straight into your Scale-Out Backup Repository as S3 Compatible object storage. Endpoint https://de-fra.i3storage.com, region de-fra, SigV4 — GDPR/DPA, 1 TB egress included per TB. From €2.49/TB.

Dùng thử miễn phí Hỏi trực tiếp chúng tôi
bash — de-fra.i3storage.com 
$ export S3_ENDPOINT=https://de-fra.i3storage.com
$ export S3_REGION=de-fra
$ aws --endpoint-url $S3_ENDPOINT s3 ls
2026-07-22  10:14  my-backups
$ rclone sync ./data intercolo:my-backups --progress
Transferred:  128 GiB / 128 GiB, 100%
S3 Compatible
SOBR Capacity Tier
No Egress
Restores without fees
Frankfurt DC
100% DE
For Veeam admins & MSPs

Your off-site Capacity Tier without the hyperscaler bill

In the Scale-Out Backup Repository (SOBR) Veeam cleanly separates the Performance Tier (fast local blocks/ReFS/XFS for restores) from the Capacity Tier (object storage for the cheap, scalable long-term copy). intercolo i3 Object Storage is exactly that Capacity Tier: S3-compatible, strong read-after-write, reached via the endpoint https://de-fra.i3storage.com in region de-fra. You offload backup chains as objects off-site — no tape robot, no second data center, no hyperscaler egress surprises — at 99.999999% durability, with data that never leaves the Frankfurt facility.

Configure SOBR: Capacity Tier in 5 steps

1

Add object storage

In the Veeam Backup & Replication console: Backup Infrastructure → Backup Repositories → Add Repository → Object Storage. Pick NOT the native Amazon S3 entry but S3 Compatible — only that type lets you set a custom service point.

2

Enter endpoint & region

Service point: https://de-fra.i3storage.com · Region: de-fra. Keep TLS on (the certificate is valid — no need to tick 'connect using untrusted certificate'). Optionally keep the gateway server on the proxy that carries the offload load.

3

Store credentials (SigV4)

Add → Access key + Secret key from your intercolo API-key pair. Access runs exclusively through these SigV4 keys — no password login. For tenant isolation, use a dedicated key pair and bucket per customer.

4

Pick bucket & folder

Select the bucket from the list (or pre-create it via aws-cli/rclone) and set a folder for these backups. One folder = one SOBR capacity extent; several jobs can share a bucket as long as each extent has its own folder.

5

Link as Capacity Tier

Open your SOBR → Capacity Tier tab → 'Extend scale-out backup repository capacity with object storage' and select the new repository. Choose Move or Copy mode plus the offload window — done. From now on the off-site copy lands automatically in Frankfurt.

Endpoint values & connection test

bash 
# Veeam S3 Compatible object storage — exact values:
#   Service point : https://de-fra.i3storage.com
#   Region        : de-fra
#   Bucket        : veeam-prod          (example)
#   Folder        : sobr-capacity       (example)
#   Access key    : <ACCESS_KEY>
#   Secret key    : <SECRET_KEY>

# Pre-check credentials with the AWS CLI (SigV4):
aws --endpoint-url https://de-fra.i3storage.com \
    --region de-fra \
    s3 mb s3://veeam-prod

# List Capacity Tier objects (after the first offload):
aws --endpoint-url https://de-fra.i3storage.com \
    --region de-fra \
    s3 ls s3://veeam-prod/sobr-capacity/ --recursive --human-readable

# Alternatively via rclone (remote 'i3'):
rclone --s3-endpoint https://de-fra.i3storage.com \
       --s3-region de-fra  ls i3:veeam-prod

Path-style: https://de-fra.i3storage.com/veeam-prod · Virtual-hosted: https://veeam-prod.de-fra.i3storage.com. Both work; Veeam uses virtual-hosted internally.

No Hardened / Immutable Repository — plan the 2nd copy correctly

Set expectations correctly: i3 Object Storage provides NO storage-side immutability (no Object Lock/WORM, no versioning). So in the SOBR do NOT enable 'Make recent backups immutable' — leave that box unchecked. The security gain here is spatial separation: this is your off-site 2nd copy under 3-2-1 (3 copies, 2 media, 1 off-site). If you need true anti-ransomware immutability, pair this target with a local Hardened Linux Repository (XFS, immutable flag) as the Performance Tier — the hard copy stays local, the cheap distance copy sits here in Frankfurt. Veeam-side client encryption (below) adds a further layer on the objects.

Restore tests without cost anxiety

Inclusive egress makes SureBackup & restores predictable

The most expensive backup mistake is the untested restore. US hyperscalers penalise every retrieval test and every real recovery with egress fees — so admins test too rarely. Here 1 TB of egress is included per booked TB of storage. You run SureBackup jobs, pull individual VMs or files back from the Capacity Tier and validate your recovery chain without the next invoice exploding. Extra traffic is billed transparently at +€3.99/TB — predictable, not surprising. This isn't 'free', it's calculable: you know what a test costs before you run it.

Inclusive egress makes SureBackup & restores predictable

Understanding tiering & offload modes

Capacity Tier

The standard target for active backup chains offloaded from the local Performance Tier into object storage. Fully browsable, granular per-object restore, strong read-after-write — ideal for the daily off-site copy.

Archive Tier

For very old, rarely needed restore points beyond your operational retention. As an S3-compatible target, i3 serves as a low-cost home for long-term GFS chains — one tier, one bill, no cold-retrieval surcharge.

Move mode

Moves backup data from the Performance to the Capacity Tier once the operational window elapses and frees local storage. Only metadata stays local. Maximum savings on expensive primary storage.

Copy mode

Copies every new restore point to object storage immediately while keeping the local copy for fast restores. Exactly the 3-2-1 pattern: a fast local copy plus an off-site distance copy in Frankfurt.

i3 vs. Wasabi vs. Backblaze B2 as a Veeam target

intercolo i3 Wasabi Backblaze B2
Location / data residency Frankfurt DC, 100% DE, GDPR/DPA EU region selectable, US corporation EU region selectable, US corporation
Endpoint https://de-fra.i3storage.com (de-fra) s3.eu-central-*.wasabisys.com s3.eu-central-*.backblazeb2.com
Egress model 1 TB incl./TB, then +€3.99/TB 'free' up to storage limit, then throttled 1 TB free/day, then per GB
Starting storage price €2.49/TB List price US$/TB List price US$/TB
Storage immutability No — 2nd copy in 3-2-1 Object Lock available Object Lock available
Support / contact Direct, German, DC team Ticket, EN Ticket, EN
Power 100% green power varies varies
Encryption that belongs to you

Client-side Veeam encryption instead of blind trust

i3 does not encrypt at rest — which is precisely why you should keep control yourself: in the Veeam job under Storage → Advanced → Storage, enable backup encryption with your own password/key. Veeam then encrypts the blocks BEFORE upload; object storage holds only unreadable ciphertext and the key never leaves your infrastructure. That is the clean path for sensitive data: transport is secured by TLS, content by your key — no provider, us included, can read the backups. Store the password safely: no key, no restore.

Client-side Veeam encryption instead of blind trust

MSP operations: one key pair and one bucket per tenant

For managed service providers clean tenant isolation is mandatory. Create a dedicated API key pair (access/secret) and a dedicated bucket per end customer and link each as a separate capacity repository in the relevant SOBR configuration or Cloud Connect tenant. Compromised or departing customers are rotated in isolation without touching other tenants. Every backup chain stays organisationally separated, billable per bucket and cleanly attributable — the foundation for auditable MSP processes at the organisational level.

Plan retention: retention & GFS instead of Object Lock

GFS chains

Your long-term restore points come from the Veeam GFS policy (weekly, monthly, yearly full backups) — not from the storage. The Capacity/Archive Tier only stores these chains cheaply; how many points are kept and for how long is defined in Veeam.

Veeam controls retention

The lifetime of every object follows your Veeam job and SOBR retention alone: Veeam writes new restore points and prunes expired ones. Since there is no storage-side lock, retention is exactly what you configure in Veeam — review those policies deliberately.

Separate repos per class

Split short-lived operational backups and long-lived GFS chains into their own buckets or capacity repositories, each with its own SigV4 key pair. That keeps retention classes cleanly isolated and the blast radius of a compromised key small.

Dịch vụ di chuyển dữ liệu

Chúng tôi di chuyển dữ liệu cho bạn

Kinh nghiệm nói lên tất cả: Chúng tôi đã hoàn thành thành công việc di chuyển nhiều petabyte dữ liệu và hơn 500 triệu file.

500M+
files migrated
Petabytes
of data migrated
since 2006
in business
Liên hệ
FAQ

Vẫn còn câu hỏi?

Hỏi trực tiếp chúng tôi
Always 'S3 Compatible' — not the native Amazon S3 entry. Only the S3 Compatible type allows the custom service point https://de-fra.i3storage.com. Enter de-fra as the region and your access/secret key pair (SigV4) as credentials.
Not on the storage side — i3 offers no Object Lock/WORM and no versioning, so leave 'Make recent backups immutable' unchecked. Use this target as the off-site 2nd copy under 3-2-1 and, if needed, pair it with a local Hardened Linux Repository for true immutability.
1 TB of egress is included per booked TB of storage, which covers regular restore tests and SureBackup runs. Traffic beyond that costs a predictable +€3.99/TB. Not 'free', but calculable in advance.
There is no storage-side at-rest encryption; transport runs over TLS. For confidentiality, enable Veeam's own backup encryption in the job — blocks are then encrypted client-side before upload, the key stays with you and only ciphertext lands in storage.
Copy mode copies every restore point to the Capacity Tier immediately while keeping the local copy — the clean 3-2-1 pattern. Move mode offloads older points and frees local storage. Many use Copy for recent points and Move for older ones.
A dedicated API key pair and a dedicated bucket per tenant, each linked as a separate capacity repository or Cloud Connect tenant. That way you rotate and isolate customers independently and bill per bucket without touching other tenants.
Both: path-style https://de-fra.i3storage.com/<bucket> and virtual-hosted https://<bucket>.de-fra.i3storage.com. Veeam addresses virtual-hosted internally; for aws-cli/rclone, --endpoint-url https://de-fra.i3storage.com with region de-fra is enough.
1 tháng dùng thử miễn phí

Thử lưu trữ tương thích S3 miễn phí trong 1 tháng.

Thử ngay Lưu trữ