Trust Center

Backups go to storage you own: your S3-compatible bucket, Google Drive, Box or Dropbox. VPS Snaps never keeps a copy. Where your server, agent or platform can upload directly, the backup goes straight from your side to your storage and never passes through us. Where it has to pass through us, it streams through memory and is never written to our disks.

What we do hold is your account, your settings, and the credentials you give us to reach your servers, clouds and storage. The rest of this page is about how that is protected.

• Credentials are encrypted at rest with AES-256-GCM, and never shown again once saved.
• Two-factor sign-in (an authenticator app) is available on every account.
• Everything travels over TLS. The database is not reachable from the internet, and the server accepts traffic only through Cloudflare.
• Sign-ins you give us are handed back at the provider, where it allows, when you delete your account.

The detail, including how to scope the credentials you give us, is on our Security page.

VPS Snaps is hosted at DigitalOcean in New York, behind Cloudflare. It is snapshotted daily, our own database is copied off-site every night, encrypted, and the restore is tested every quarter, so it can be recovered within hours if it is ever lost.

We target 99.9% uptime, but do not offer a contractual uptime SLA. If you need one, tell us before subscribing.

These companies process personal data for us, and only for what is listed:

The clouds and storage you connect are not our subprocessors: you hold those relationships directly. We give notice before adding or replacing a subprocessor, as our Data Processing Addendum sets out.

• We do not hold a SOC 2 report or an ISO 27001 certificate. We are working towards both. We run an information security management system built to ISO 27001, with the SOC 2 security, availability and confidentiality criteria mapped onto it, but nothing has been audited yet.
• External scans: the site and the code were scanned by outside tools in September 2026, and every finding was fixed or dismissed with a reason. We have not commissioned a penetration test.
• Data protection: our Data Processing Addendum covers GDPR processing, and our Privacy Policy says what we collect and why.

When an audit is passed, this page will say so, with the report's date. Until then it says this.

Service status and any incident are published on our status page as they happen. If an incident affects your data, we email the account owner directly.

If something on this page changes in a way that matters to you (where your data is processed, a new subprocessor, how credentials are protected), we email account owners before it takes effect. Smaller corrections are made here directly.

Email [email protected] with enough detail to reproduce it; a person reads every report. Our security.txt has the same contact, and the Security page says how we handle reports made in good faith.