Security & Isolation

Every app you deploy runs in a completely separate environment — isolated from all other customers at the operating system level.

• Each app runs under its own dedicated system user with no login shell. Even if your code has a bug, it cannot touch another customer's files.
• Your app process can only write to its own directory. The rest of the filesystem is read-only.
• Apps bind to a private internal port on localhost only — they are never directly reachable from the internet. All public traffic goes through our secure nginx proxy.
• Systemd enforces hard limits: no privilege escalation, private temporary directories, and no Linux capabilities granted.

Shared hosting and WordPress sites run under CageFS — a kernel-level filesystem virtualisation layer that gives every customer a private, isolated view of the server — while the server kernel itself is patched against new vulnerabilities automatically, with no downtime.

• CageFS wraps each account in its own virtual filesystem cage. Your account cannot see or access any other customer's files, processes, or configuration.
• PHP executes inside the cage under your account's user. Scripts cannot escape to read other accounts' data.
• WordPress sites are provisioned with isolated database credentials and file permissions scoped to your account only.
• The server kernel is patched against newly disclosed security vulnerabilities automatically with KernelCare — critical fixes are applied live, with no reboots and no downtime for your sites.

Email is powered by Mailcow, where every component runs in its own Docker container — isolated at the process and network level.

• SMTP, IMAP, spam filtering, and the webmail UI each run in separate Docker containers with their own filesystem and network namespace.
• Mailboxes are isolated per domain. No cross-domain or cross-customer access is possible.
• All connections use TLS encryption. DKIM, SPF, and DMARC records are configured automatically to protect your domain's sending reputation.

VPS customers receive a fully dedicated virtual machine — the strongest isolation available, with no shared kernel or memory.

• Your VPS is a dedicated Proxmox VM with its own virtual CPU, RAM, and disk image. No other customer shares your kernel.
• Network traffic between VMs is isolated at the hypervisor level. Your VPS cannot reach another customer's VM on the internal network.
• You have full root access and can install any software, configure firewalls, and manage users entirely on your own terms.

Domain and DNS management is secured through authenticated control plane calls — no customer can view or modify another's records.

• Every DNS change is authenticated with your session before it is sent to the registrar. No action can be taken on your domain without your credentials.
• Each domain is associated with your account only. Other customers have no visibility into your DNS configuration.
• Free SSL certificates are provisioned automatically via Let's Encrypt for every domain and subdomain you add.

All services sit behind Cloudflare, which absorbs attacks and enforces SSL before traffic reaches our servers.

• Cloudflare proxies all public traffic, hiding our server IPs and blocking volumetric DDoS attacks before they reach the origin.
• TLS 1.2+ is enforced across every service — no unencrypted HTTP is served to end users.
• Our automated security system detects brute-force and injection attempts in real time and blocks offending IPs at the Cloudflare edge.
• Internal APIs between our control plane and runtime servers use shared-secret authentication and are never exposed to the public internet.

Automated attacks against websites are constant and indiscriminate — they look for any site running common software, not for you specifically. Every site we host is watched for them around the clock, and the protection is part of your plan: nothing to buy, install, or configure.

• Repeated failed WordPress login attempts from the same source are detected and blocked automatically, before they can guess a password.
• Abuse of WordPress's remote-access interface — a common route for password guessing and for amplifying attacks against others — is detected and shut down.
• Automated scans probing for exposed installer and setup pages are blocked before they reach your site.
• Protection is shared across the platform: an attacker stopped at one site is blocked from every site we host, both at our own firewall and at Cloudflare's global edge — so they are turned away before the traffic ever reaches the server.
• WordPress background tasks run on a real schedule instead of on visitor page loads, so neither a traffic spike nor an attack can exhaust your site's resources.
• Each account has its own guaranteed share of server resources, so a neighbouring site under attack cannot slow yours down.
• Your data is backed up every day to encrypted off-site storage, held separately from the server it runs on.
• All of this is included on every plan, at no additional cost.