Trust isn't a marketing word.
Here's what we actually commit to.

Who runs ServerCrate

ServerCrate is run by a small, deliberately lean engineering team. We handle every part of the stack ourselves - infrastructure, customer support, billing, the website you're reading - because that's how trust gets built and decisions stay fast. It's a deliberate choice, not a stage-one startup waiting to scale into something more impersonal.

What it doesn't mean: that we're going anywhere. Tarsnap has operated as an independent specialist for over a decade. rsync.net is family-owned and has operated since 2001. Independent specialists in this niche outlast venture-backed companies because they don't have to grow or die.

Where the data lives

• Single location:Los Angeles, US West Coast. Owned hardware with redundant power and a business-grade network uplink. We are not a multi-region datacenter and do not claim to be. Low latency for North American users.
• Storage backend:OpenZFS on Linux, with checksumming on every block. Snapshots and integrity verification run continuously. Bit rot on long-tenure archives gets caught and corrected.
• Network:Static IPv4/IPv6 on a business-grade uplink. HTTPS only - no plaintext protocols, no public file shares, no unauthenticated endpoints.
• Encryption:Client-side, AES-256, via Restic's own crypto stack. Your password generates the encryption key. We see ciphertext only.

Operating commitments

These are commitments, not aspirations. If we break any of them, you have grounds to leave with full refunds and exported data:

• 90-day shutdown notice:If ServerCrate ever shuts down, you get 90 days of advance notice with the service running normally and full export tooling available. No "service ends in 30 days" emails.
• No silent data deletion:We will never delete vault data without explicit written request from the account holder. Account suspension freezes vaults - it does not erase them.
• Standard Restic format:Your vault is a standard Restic repository. If you ever leave ServerCrate, you can restic copy the entire repository to any other Restic-compatible target. No vendor lock-in.
• Pricing freeze for existing customers:If we raise prices, existing customers stay on their current plan rate for 12 months minimum. New customers pay the new rate. No surprise invoice changes.
• No third-party data sharing:We do not share customer metadata, vault sizes, snapshot timestamps, or login records with anyone outside ServerCrate's operation. The only exception is a valid legal process - and even then, all we have is ciphertext.

What we genuinely cannot guarantee

Honest disclosure of the things we can't control:

• Your encryption password:If you lose it, the data is mathematically unrecoverable. This is the cost of true zero-knowledge encryption. Store the password in a password manager. Print it. Both.
• Site-level disaster:A single LA location means a major regional event (earthquake, fire, sustained grid failure) is a worst case. Mitigation: customers should follow the 3-2-1 rule with at least one local copy. ServerCrate is your offsite - not your only - backup.
• Support response:At our current scale, support response targets are 24 hours, not 4. We don't claim a 99.99% uptime SLA we can't enforce at this size. Status is published live at status.servercrate.net.

How to verify any of this

Our public artifacts live on the downloads page: the open-source restic-toolkit, our PGP signing key (for verifying release signatures and the warrant canary), and the signed canary statement itself.

Trust requires verification. Here's how to check our claims yourself:

• Live status:status.servercrate.net shows real-time uptime for every public service. Operated by Uptime Kuma.
• Test the encryption claim:Provision a free vault. Upload a known file. Email support and ask us to read its contents. We will not be able to. Anyone in the support channel can verify this on demand.
• Test the export claim:Your Restic repository on ServerCrate is byte-identical to a Restic repo anywhere else. restic copy from your vault to another backend moves every snapshot out. We don't have hooks that prevent this.
• Direct human contact:Reach us via /contact/. Replies come from the same small engineering team, no outsourced front line.

What this page is not

This page is not SOC 2 Type II attestation. We don't hold one, and we won't claim it until it's actually certified. This page is not a substitute for your own threat model - if you're storing data subject to regulatory frameworks (HIPAA, GDPR processor obligations, SEC retention), evaluate the actual requirements against what's documented here, and ask us specific questions before signing up.

This is what we can credibly commit to right now. As ServerCrate grows, those commitments grow with it - but they only get stricter, never looser.