ServerCrate is a privacy-first product. The way it works at the protocol level is the security model — there's no separate "trust us" layer.
Your files are encrypted on your device by Restic before any data leaves your network. Restic uses authenticated encryption with AES-256 in counter mode and Poly1305 for integrity. The encryption key is derived from your repository password using scrypt — a memory-hard KDF designed to resist GPU and ASIC attacks.
We never see, store, or transmit your encryption key. We see ciphertext only. If you lose your password, your data is unrecoverable — including by us. That's not a bug; that's the contract.
All data in transit travels over SFTP (SSH File Transfer Protocol) using OpenSSH. Each vault has a unique SSH host key (no shared host keys across customers). Connections are authenticated with username + password generated at provision time and shown in the portal once.
Even if the SFTP connection were intercepted, all transferred data is already Restic-encrypted ciphertext. The SFTP layer is defense in depth, not the primary boundary.
Every customer gets a dedicated ZFS dataset on our storage pool. Datasets are isolated at the filesystem level — they cannot read each other's data, share inodes, or escape their boundaries. Each vault runs in its own LXC container with a chrooted SFTP user that cannot navigate above its dataset.
ZFS provides end-to-end data integrity via cryptographic checksums on every block read and write. If a disk silently corrupts a sector, ZFS detects it on the next read and (with the right pool topology) self-heals from redundancy. Your backup target won't quietly rot.
We do not log file names, file paths, snapshot contents, restore content, or anything that could reveal what's inside your vault. Restic's wire protocol doesn't expose that information to us, and we've made no effort to derive it.
The system is designed against three threat classes:
The system is not designed against an attacker who has compromised your machine and exfiltrated your repository password. That's a separate boundary — your endpoint security is your responsibility. We recommend storing your Restic password in a hardware-backed password manager.
Storage runs on owned hardware in a US Tier-3 colocation facility with redundant power and network. Public network reach is provided by an upstream BGP partner with a leased IPv4 /24, ensuring our customer-facing endpoints don't depend on a single transit provider's reachability.
Operating systems are Debian 12 stable on Proxmox VE host nodes. ZFS is the OpenZFS upstream. All systems are CrowdSec-enrolled with nftables-based bouncing for IP-level abuse mitigation.
For business customers requiring detailed infrastructure information for compliance reviews (SOC 2, HIPAA, GDPR DPIAs), contact us and we'll walk through the specifics under NDA.
In the event of a confirmed security incident affecting customer data or service availability, we commit to:
Security researchers: please email security@servercrate.net with findings. We aim to acknowledge within 48 hours and provide a remediation timeline within 7 days.
We don't yet operate a formal bounty program — we're a small operation — but verified vulnerability reports get public credit (with consent), free Pro plan time, and our genuine thanks. Please don't run automated scanners against production.
restic check on a schedule to verify repository integrity from your end.Questions about anything on this page? Email security@servercrate.net. We answer security questions seriously and quickly.