Quick Answer
Archive/ Glacier-class object storage in India can cost as little as ₹0.07 per GB each month, but price is only the starting point. For Indian startups, the real value comes from combining low-cost archival with retention rules, immutable backups, tested recovery and evidence for regulators, customers, insurers and investors.
It is 2 a.m. and a ransomware alert has just lit up your phone. Your primary database is locked and unreachable, so the team reaches for the backup. Instead, you find the backup encrypted too because it lived in the same account with the same access as everything else.
Every founder who lives through a night like this learns the same lesson. The real problem was never the price tag on the storage. Glacier decisions in India come down to four pressures. These are cost and compliance and ransomware defense and investor credibility.
This piece gives you the real pricing the DPDP rules the ransomware numbers and the questions your insurer and investor will ask before you need any of it.
What is Glacier Storage and Why Do Startups Get It Wrong?
Glacier is a storage class built for data you need to keep but rarely access. Think long-retention backups, audit evidence, historical logs and compliance records that are rarely accessed. Do not use the deepest archive tier for operational backups that must restore within minutes unless the recovery plan accounts for restore latency. Most startups treat it purely as a cost lever. That’s exactly where the mistake starts.
Storage tiering is consistently the most skipped item in Indian cloud cost audits. Deloitte reports that up to 30% of cloud spending may be wasted because of limited cost visibility, overprovisioning, unplanned expenses and the complexities of pay-as-you-go pricing.
Founders optimize what they can see easily. They rarely audit what they can’t like years of dormant data sitting in the wrong tier.
Which Startup Workloads Belong in Glacier?
| Startup type | Suitable archival examples |
|---|---|
| SaaS | Database snapshots, tenant exports and audit logs |
| FinTech | Transaction evidence, reconciliations and security logs |
| HealthTech | Historical records, imaging archives and consent evidence |
| AI companies | Training snapshots, model versions and raw datasets |
| DevOps / Platform teams | Build artefacts, long-term logs and recovery copies |
Not every dataset should use the deepest tier. A recovery copy that may be needed urgently could suit Instant or Flexible Retrieval, while multi-year records rarely accessed may suit Deep Archive. Tiering should follow business impact, not age alone.
How Much Does Glacier Storage Actually Cost in India?
Moving 1TB of data from Standard storage to Glacier Deep Archive cuts the monthly cost from roughly ₹840 to roughly ₹72. That’s a reduction of about 91%. That’s the number every cost pitch leads with. It’s also only half the story.
| Storage class (India) | Approx. price per GB/month |
|---|---|
| S3 Standard | ₹0.78 to ₹0.85 |
| S3 Standard Infrequent Access | ₹0.47 |
| S3 Glacier Instant Retrieval | ₹0.17 |
| S3 Glacier Flexible Retrieval | ₹0.16 |
| S3 Glacier Deep Archive | ₹0.07 |
At the ₹0.78 Standard rate, 1 TB costs about ₹799 a month. The same volume in Deep Archive costs about ₹72 before taxes, retrieval and request charges: roughly 91% less for storage alone.
Retrieval changes the calculation. Flexible Retrieval lists expedited request charges of ₹408 per 1,000 requests, compared with ₹2.04 for standard requests. Expedited data retrieval is ₹1.22 per GB, compared with ₹0.41 for standard retrieval. Deep Archive is cheaper to hold, but retrieval can take hours.
Moving or deleting an object before its 90-day or 180-day minimum can trigger early-deletion charges. Small objects may also carry minimum billable sizes or metadata overhead.
Before you commit to a tiering strategy, understand how object storage tiering works which classes suit which data, when to move between tiers, and how to avoid over-archiving.
Does DPDP Require Companies to Delete Old Data?
Yes. Under the DPDP Act, Data Fiduciaries must erase personal data when consent is withdrawn or when the specified purpose is no longer served, unless retention is necessary for legal compliance. Avoid saying every dataset must be deleted immediately after purpose served; retention must be mapped to lawful purpose, statutory retention and data-principal rights. Indefinite retention is no longer lawful by default, and this applies to startups of every size not just large enterprises.
This changes what keeping data in Glacier forever actually means. Section 8(7) of the Act and Rule 8’s retention schedule turn dormant forgotten data such as old user records or logs nobody remembers exist into a direct liability rather than a harmless cost.
DPDP allows fines of up to ₹250 crore per violation for failing to implement reasonable security safeguards. IBM’s 2025 Cost of a Data Breach Report found the average cost of a data breach in India reached at $2.51 million.
Component costs for DPDP readiness such as consent platforms and data audits can range from roughly ₹1 lakh to ₹15 lakh a year depending on scale.
Cold storage is a cheap tier. Compliant archival adds retention schedules and audit logs and provable deletion. Glacier gives you the first. DPDP requires the second.
Can Ransomware Destroy Data Sitting in Cold Storage?
Ransomware can destroy or make cold-storage backups unrecoverable if attackers obtain credentials that can delete objects, alter lifecycle rules, remove retention controls, overwrite versions or compromise encryption keys. Immutability reduces this risk only when correctly configured and isolated.
Most default cloud backup setups aren’t. Veeam’s 2024 research found that ransomware groups targeted backup repositories in 96% of attacks and succeeded in compromising them 76% of the time because a compromised backup removes a victim’s only real leverage to refuse payment.
Attackers have also gotten faster. CrowdStrike’s 2026 Global Threat Report found average breakout time from initial access to lateral movement fell to around 29 minutes a 65% acceleration from the year before.
Most incident response plans still assume there is time to react before an attacker reaches the backup layer. That assumption is what actually gets punished. Mastercard’s 2025 survey found that nearly one in five small business owners hit by a cyberattack went on to file for bankruptcy or close entirely.
The defense that works is backup storage that’s immutable (WORM) and air gapped and regularly tested for restoration. A correctly configured Glacier class archive can provide this. A standard hot tier backup usually doesn’t.
Learn how to design a multi-tier backup strategy that isolates Glacier from hot tiers and protects against lateral movement.
How is Compliant Archival Different from Cold Storage?
Cold storage is a storage tier offering cheap bytes with slow retrieval. Compliant archival is a governed capability including retention policy and searchability and audit logging and provable deletion. It may use a cold storage tier underneath but isn’t defined by price alone.
| Factors | Raw cold storage | Compliant archival |
|---|---|---|
| Primary goal | Lowest storage cost | Controlled retention and recovery |
| Retention | Manual or informal | Documented and enforced |
| Immutability | Optional | Required where risk demands it |
| Auditability | Basic records | Traceable access and deletion |
| Erasure | Manual | Policy-led and legally validated |
| Recovery | Assumed | Regularly tested |
| DPDP readiness | Not automatic | Built around purpose and retention |
A startup can use Glacier underneath a compliant archive, but the class does not create governance. The test is whether the company can show what it retains, why it retains it, who accessed it, and what happened when the retention period ended.
Do Cyber Insurers and Investors Actually Check Backup Practices?
Increasingly, yes. Many cyber insurers ask about immutable or isolated backups, MFA, EDR, patching, incident response, and tested restoration before binding coverage. Self-attestation alone no longer qualifies, though specific requirements vary by underwriter.
Munich Re expects the global cyber insurance market to reach roughly $16.3 billion in premiums in 2025 continuing a sustained expansion driven by rising cyber losses.
The same scrutiny has reached fundraising. Indian VC and PE due diligence for data driven startups increasingly includes a dedicated IT and cybersecurity audit, not just the usual financial and legal review, and investors expect a documented audit trail of who accessed which data and when.
Two very different gatekeepers are now asking the same question. Can you prove how you handle your data rather than simply claiming you have backups somewhere.
Does Data Localization Apply to Startups or Only to Banks?
No. India does not impose one blanket rule requiring every startup’s cloud backup to remain inside the country.
The Reserve Bank of India’s April 2018 direction requires payment-system data handled by authorised payment-system providers to be stored only in India. Other regulated sectors may have their own rules. The DPDP Act allows the government to restrict transfers to notified countries, but it does not currently create universal localization for every business.
India-hosted archive storage can help with regulated workloads, latency and customer assurance. But residency and sovereignty are not identical. Assess physical storage location, replication/backup location, support access, provider jurisdiction, encryption-key ownership, audit logs, contracts and RBI payment-data localization rules.
Final Takeaway
Glacier Storage for Indian Startups matters because it can reduce long-term cloud cost without forcing every dataset into expensive hot storage. But the real advantage appears only when low-cost capacity is combined with deliberate retention, immutability, isolated access, and tested recovery.
At AceCloud, the relevant foundation is India-hosted, S3-compatible object storage with published INR pricing across Standard, Infrequent Access and Glacier classes. That can simplify tiering and residency decisions, but no storage class makes an archive compliant or ransomware-proof by default. Architecture, policy and evidence still do the hard work.
Frequently Asked Questions
Not by default. Glacier is a storage class rather than a complete governance system. DPDP readiness requires defined retention purposes, controlled access, security safeguards, audit records, and a process for erasing personal data when it is no longer legally required.
Published AceCloud pricing for the Noida region starts at approximately ₹0.07 per GB per month for Glacier Deep Archive. That makes 1 TB roughly ₹72 per month for storage alone, before taxes, retrieval requests, data retrieval and early-deletion charges.
Yes, when attackers obtain credentials with permission to delete objects or modify lifecycle and retention settings. Cold storage should be combined with immutable or WORM controls, separated identities, restricted permissions, multifactor authentication, and tested recovery.
Cold storage is a low-cost technology tier for infrequently accessed data. Data archiving is a broader governed process covering classification, retention, searchability, access control, auditability, deletion, and recovery. A compliant archive may use cold storage, but the two terms are not interchangeable.
Not every startup is subject to a blanket localization requirement. RBI rules apply specifically to payment-system data handled by authorized payment-system providers, while other sectors may have separate obligations. Startups should assess their industry rules, customer contracts, and cross-border transfer requirements.
The storage class alone does not determine eligibility. Insurers may examine whether backups are isolated, immutable, protected through separate privileged access and regularly restored in tests. Strong evidence of recoverability can improve underwriting confidence, but it does not guarantee coverage or a particular premium.
