Data Processing Agreement

#1. How to get the DPA

Email privacy@servercrate.net from the email address on your account. Tell us the legal name of your organization and which services you use. We send you the Data Processing Agreement to review and sign.

This page is a summary. The signed agreement is the document that governs, together with our Terms of Service.

#2. Roles and scope

You decide what data you store with us and why. For personal data in your backup vaults, cloud servers and hosted websites, we act as your processor: we store and serve that data for you and do nothing else with it.

The account and billing information we collect to run your account is covered by our Privacy Policy.

#3. Processing on your instructions

We process your data only on your documented instructions. Those instructions are the agreement itself, our Terms of Service, and the way you configure and use the services, for example the backups you upload, the servers you create and the sites you publish.

We do not use your data for any purpose of our own, and we do not sell it.

#4. Confidentiality

Everyone on our team who can access systems holding customer data is bound by confidentiality obligations.

#5. Security measures

The agreement commits us to the measures on our Security page. In summary:

• Encryption: restic encrypts backups on your machine before upload (AES-256 in counter mode with Poly1305-AES authentication). The encryption password never reaches us, so we cannot read backup contents or file names, and we cannot recover a lost password.
• Transport: HTTPS, with hybrid post-quantum key exchange (X25519 with ML-KEM) where your client supports it.
• Vault isolation: each vault is its own isolated container with its own credentials. Vaults are append-only for the backup key, and deletion needs a separate cleanup key.
• 14-day storage-level lock: daily ZFS snapshots of vault storage, kept for 14 days outside the vault's container.
• Infrastructure: our own hardware, isolated customer server networks, a private management network, key-only SSH administration, prompt security updates, host intrusion detection, centralized security monitoring (SIEM), automated blocking of abusive IP addresses, and firewalls by default.
• Access: mandatory two-factor authentication for our staff accounts; optional TOTP two-factor and passkeys for yours, with a security activity log and session revocation.

#6. Subprocessors

Backup data, cloud servers and hosted websites stay on our own hardware. The outside services below receive only the account or billing data each one needs:

• Stripe: card payments.
• PayPal: PayPal payments.
• VoIP.ms: phone verification and opt-in text messages, if you add a phone number.
• Openprovider: domain registration, for domain customers only.

Bitcoin payments go through BTCPay Server, which we host ourselves. Transactional email is sent through our own mail servers. Upstream network providers carry encrypted traffic to and from our network and receive no account data. We will update this list before adding a subprocessor that can see customer data.

#7. Breach notification

If we become aware of a personal data breach affecting your data, we notify you without undue delay. As our Security page sets out, we disclose confirmed incidents on our status page within 72 hours, email every affected customer with what was and was not accessed, and publish a post-incident report within 14 days. We cooperate with your team as you meet your own notification duties.

#8. Data subject requests

If someone asks you to access, correct or delete their personal data, we help you respond, taking into account what we can technically reach. Your backups are encrypted with a password only you hold, so requests that concern backup contents are carried out with your own restic tools; we can delete a whole vault on your instruction. If a request reaches us directly, we pass it to you.

#9. Deletion at the end of service

When a paid service ends, it is suspended at the end of the billing period and permanently destroyed after the grace period shown in your portal and in our billing emails, as described in section 6 of our Terms of Service. Vault data is deleted within 30 days of deprovisioning, unless a longer retention period is legally required.

Before your service ends, you can copy your vault to any other restic storage with stock restic. Billing records may be kept for up to 7 years for accounting and compliance purposes.

#10. Data location

Customer data is stored on hardware we own and operate in Los Angeles, United States.

#Changelog

• October 27, 2026 - First published.