Security

We never store your backups. There is no bucket here holding your data. Backups land in storage you own and control, and that is the single biggest thing separating our risk profile from a service that keeps your backups for you. We are not a place where your data sits, so we are not a place where it can be taken from.

For almost everything, the data does not touch us at all: a provider snapshot happens entirely inside your cloud account, and a server backup — over SSH, through an agent, or through the WordPress plugin — streams from your machine straight to your storage. If we were breached tomorrow, none of that would be part of it.

There is one exception and it is worth stating plainly rather than burying. Managed hosting platforms give you a database but no server to run anything on. To back one of those up, the export has to run somewhere, and that somewhere is us. It is streamed to your storage as it is produced, never written to our disks and never retained — but for the length of that transfer, your data passes through our infrastructure. Every job says which of the two it is.

To do its job, VPS Snaps holds provider API tokens and SSH keys. These are the most sensitive things we store, and they are treated accordingly.

• Every credential is encrypted at rest with AES-256-GCM, an authenticated cipher — meaning tampering with the stored ciphertext is detected rather than silently decrypted into something else.
• Each value is encrypted with its own random initialisation vector, so identical secrets do not produce identical ciphertext.
• The encryption key lives in the server environment, never in the database. A database dump on its own does not decrypt anything.
• Credentials are decrypted only in memory, at the moment a job runs, and are never written to logs.

Where a provider supports OAuth — DigitalOcean, Linode, Google Compute Engine — we use it in preference to an API token, so there is no long-lived secret for you to copy and for us to hold.

• Passwords are hashed with bcrypt. We cannot read your password, and neither can anyone who obtains the database.
• Two-factor authentication is available using any TOTP app. Recovery codes are themselves hashed, not stored in readable form.
• Sessions are signed tokens with a limited lifetime. The session cookie carries no personal data.
• Every query is scoped to your workspace. Data belonging to one workspace is not reachable from another.
• Sign-up is protected by Cloudflare Turnstile to keep automated abuse off the platform.

• VPS Snaps runs on a dedicated server in DigitalOcean's New York region. It is not shared with other tenants or applications.
• All traffic is served over TLS. The database is not exposed to the public internet.
• Automated daily checks report failed backups, process restarts and disk pressure, so problems surface without waiting for a customer to notice.

Security pages are usually a list of reassurances. It is more useful to be straight about the boundaries, so you can judge whether this fits your requirements:

• We do not hold a SOC 2, ISO 27001 or comparable certification. VPS Snaps is a young product and has not been through a formal audit.
• We have not commissioned an external penetration test. If you need one before adopting a vendor, tell us — that is a reasonable requirement and worth knowing about.
• We do not offer a contractual uptime SLA. If your use case depends on one, get in touch before subscribing rather than after.

If any of this changes, this page changes with it. We would rather lose a sale than win one on a claim we cannot support.

Two things materially reduce your exposure, and both are in your hands:

• Scope the credentials you give us. Where your provider supports restricted tokens or IAM policies, grant only snapshot and storage permissions rather than full account access.
• Turn on two-factor authentication. Your VPS Snaps account can reach your infrastructure, which makes it worth protecting as carefully as the infrastructure itself.

If you believe you have found a security issue, email [email protected] with enough detail to reproduce it. Reports are read by a person, not a queue, and you will get an acknowledgement.

Please give us a reasonable opportunity to fix an issue before disclosing it publicly. We will not pursue legal action against anyone who reports a vulnerability in good faith and without accessing or modifying other customers' data.