A managed server comes with patching, monitoring, backups and incident response from the provider. An unmanaged one gives you the machine and root access, and everything else is yours. This page compares who does each job, which legal duties stay with you, and what in-house time really costs.
| Criterion | Managed server | Unmanaged server |
|---|---|---|
| Security updates | Applied by the provider, on a schedule | Applied by your team |
| Monitoring and alerts | Set up and watched by the provider | You install and watch them |
| Backups | Policy defined in the contract | Written, scheduled and verified by you |
| Restore test | Included or on request, per contract | Only if you plan it |
| Incident response | The provider's team steps in | You, including nights and weekends |
| Initial hardening | Standard profile applied at delivery | You start from the base image |
| Freedom to configure | Limited by the provider's policies | Full, with root access |
| Monthly cost on the invoice | Higher | Lower |
| Hidden cost | Small | In-house operations hours |
There is no standard definition of 'managed'. One provider means operating-system updates only; another adds monitoring, verified backups and incident response. Before you sign, ask for the list of tasks and response times in writing. Check whether your application is in scope or only the operating system and base services, and who pays for a restore after a mistake made by your own team. A clear contract prevents the classic situation: the server is 'managed', yet the database has no backup because nobody asked for one.
An unmanaged server looks cheaper on the invoice, but the cost moves into your team's hours. Monthly updates, alert checks, log rotation, certificate renewals and a restore test take several hours a month even on a single server. Add availability: someone has to answer when the server falls over at three in the morning. Work out the real hours per month, multiply them by your internal hourly cost, add the risk of an outage, and only then compare the total with the price gap between the two options.
GDPR Article 32 requires the controller to apply technical measures suited to the risk, including the ability to restore access to data in good time and to test those measures regularly. The duty stays with you even when a provider runs the server, which is why you need a processing agreement under Article 28. For essential and important entities, NIS2 applies in Romania through OUG 155/2024, approved by Law 124/2025, with DNSC as the competent authority, and it brings strict incident-reporting deadlines. A good provider supplies evidence, but it does not sign off your compliance for you.
Between the two extremes sits a mixed model. You get a server with root access, and your plan includes a monthly number of DevOps, CyberSecurity or programming hours. You spend them on hardening, backup setup, a restore test or tracing an alert. The model works only if you know its limits: the hours are a quota, not a promise of permanent intervention. They are requested from the client panel, they are not carried over from month to month, and anything above the quota is accepted and billed separately. Continuous operation outside working hours still needs a dedicated contract or your own team.
A shop with a few thousand orders a month stores billing details and customer addresses. With no administrator on staff, the managed option lowers the risk of a critical patch sitting unapplied for weeks. The contract should name a daily database backup and a quarterly restore test.
Two engineers who work with Terraform and Ansible rebuild the server from code in under an hour. An unmanaged server is the logical choice here: the team controls the versions, and a managed provider would only add a middleman between the people who already know the system and the system itself.
A clinic holds health data, a special category under GDPR. Even with a good technical provider, the clinic stays the controller. A server with included DevOps hours can cover hardening and backup setup, but the clinic must document its measures itself and check restores on a regular schedule.
An unmanaged server comes with hardware, network, an installed operating system and root access. The provider answers for the availability of the machine and the network. Updates, security, application backups and incident response are the customer's responsibility.
Not entirely. Included hours cover planned work: hardening, backup configuration, a restore test or the analysis of an alert. You request them from the client panel, they are not carried over, and they do not guarantee permanent monitoring. For continuous operation outside working hours you need a dedicated contract or your own team.
The data controller, meaning your company, notifies ANSPDCP within 72 hours of becoming aware of the breach, under GDPR Article 33. The provider, as processor, must tell you without undue delay. The Article 28 agreement you sign defines how that happens.
Choose a managed server if nobody on your team owns operations; choose unmanaged only if your own people already handle patching, backups and incident response.
