Cyber-insurance applications ask whether your backups are offsite, immutable and encrypted, and whether MFA protects them. Every paid ServerCrate vault now gets a monthly report that answers those questions with facts our systems measure, signed with our ed25519 key so anyone can check that nothing was changed.
States ServerCrate-side facts only. Not a compliance certification and not an insurance guarantee.
The backup questions on common cyber-insurance applications are short and blunt: offsite, immutable, encrypted, how often, MFA, tested. Every line of the report is phrased the same way, with a PASS, WARN, ACTION or FAIL next to it and the measurement behind it. The broader list of what insurers ask, and how to prepare for each, is in our cyber insurance backup requirements checklist.
| The question | What the report states, and how we know |
|---|---|
| OffsiteAre backups kept separate from your network? | Your vault is stored by ServerCrate in Los Angeles, on hardware, network and credentials separate from your systems. |
| Append-onlyCan backups be modified or deleted with the credentials your systems use? | We confirm the vault’s backup server is running in append-only mode: the backup key on your machines can add data but cannot delete or overwrite it. Pruning needs a separate maintenance key, which does not have to live on the machine being backed up. |
| ImmutableAre backups immutable within their retention window? | Daily storage-level ZFS snapshots of your vault, kept for 14 days. They sit below the backup server, so no customer key, prune or ransomware on your side can remove them. The report lists how many are held and the oldest and newest dates. |
| EncryptionAre backups encrypted? | restic encrypts on your device before upload, with AES-256 and authenticated encryption. We never receive your password or key, so neither we nor anyone who breaches us can read your data. |
| IntegrityIs the stored backup data intact? | restic names every stored file after the SHA-256 hash of its contents. We re-hash the stored files and compare, which needs no key. Any mismatch is reported as FAIL with the count. |
| RecencyHow recent are your backups? | The time of the last backup we received and the number of snapshots stored. PASS within seven days, WARN after that. |
| MFAIs MFA required to access your backup account? | Whether two-factor authentication is on for the ServerCrate account that controls the vault. If it is off, the line reads ACTION and says where to turn it on. |
| RestoreHave restores been tested? | The date of the most recent restore we observed from this vault. If there is none yet, the line reads ACTION and gives the command to run one. |
What it is not. The report states facts about how ServerCrate stores your vault. It is not a compliance certification, an audit opinion or a promise that any insurer will accept your application. You still answer the application yourself. The report is the evidence behind your backup answers.
Nothing in the report is typed in by a person, and nobody can edit a line without breaking the signature. Your insurer, broker or auditor can check it in under a minute with our published key.
| Signature | ed25519 over the canonical JSON: sorted keys, compact separators |
|---|---|
| Public key | servercrate.net/.well-known/sc-evidence-key.pem |
| Fingerprint | Printed on every report and stored in the signed JSON |
| Address | servercrate.net/evidence/<unguessable id>/ |
| Files | Web page, report.pdf, report.json |
| Cadence | Monthly, one report per paid vault |
Output from a real report signed by our evidence key. The PDF and web page carry the same facts; the signed JSON is the original.
The cyber-insurance application lands once a year and asks about backups in plain yes-or-no terms. The person signing it is attesting that the answers are true. A dated report from the provider that actually holds the backups is a better basis for those answers than a recollection of how things were set up.
The FTC Safeguards Rule covers tax preparation firms, and it requires customer information to be encrypted at rest and in transit and MFA for anyone accessing information systems. The IRS expects paid preparers to keep a written information security plan, and its guidance for tax professionals covers backing up and encrypting client data. The report is a monthly record of how your backup copy is stored that you can file alongside that plan. It does not replace the plan or your other Safeguards obligations.
Each client vault gets its own report and its own link. Forward it with the renewal paperwork instead of screenshots of a dashboard, and let the client’s broker verify it without logging in to anything.
No. It states facts that ServerCrate measures about how your vault is stored, signed so they cannot be altered. It is not a certification, an audit opinion or a statement that your organization is compliant or insured. You still answer your insurance application or audit yourself; the report is evidence for the backup answers.
No. Underwriting decisions belong to your insurer, and applications ask about much more than backups. The report gives you a dated, verifiable record of the backup facts we can measure, so the answers you sign are backed by something more than memory.
The report says so. A problem on our side, such as a stored file that fails its hash check, shows as FAIL and alerts our engineers. Items you control, such as two-factor authentication or a restore test, show as ACTION with the exact step to fix them. A late backup shows as WARN. We do not hide or soften a result, and the next monthly report reflects the fix.
Yes. Every report comes with a signed JSON original, and our public key is published at /.well-known/sc-evidence-key.pem. A short Python 3 command, shown above, checks the ed25519 signature and prints valid. Change any character in the report and the check fails. The web page and PDF are readable copies of the same signed facts.
No. Your backups are encrypted on your device by restic, and we never receive the password or key. Every check runs on our side without it: the integrity check re-hashes encrypted files against their SHA-256 names, and the other checks read storage, server and account settings. Our security model covers the rest.
Every paid backup vault plan includes it at no extra charge: Lite at $2/mo, Starter at $3/mo, Standard at $9/mo, Pro at $17/mo and Business at $35/mo (currently waitlisted). The free tier does not include it. Full details are on the pricing page.
We do not sign Business Associate Agreements. If your organization needs a BAA from its backup provider, ServerCrate is not the right fit today, and this report does not change that.
No add-on and no separate price. Open a paid vault, run your first backup, and the next monthly report covers it.
| Plan | Price | Storage | Devices | History |
|---|---|---|---|---|
| Lite | $2/mo | 100 GB | 3 | 14 days |
| Starter | $3/mo | 250 GB | 10 | 30 days |
| Standard | $9/mo | 1 TB | 25 | 60 days |
| Pro | $17/mo | 2 TB | 50 | 90 days |
| Business waitlist | $35/mo | 5 TB | 100 | 180 days |
No egress or restore fees. 30-day money-back guarantee. The report states ServerCrate-side facts only and is not legal, compliance or insurance advice.