Who runs ServerCrate
ServerCrate is operated by one person — a single technical operator running every part of the stack: infrastructure, customer support, billing, the website you're reading. This is a deliberate choice, not a stage-one startup that's about to scale. Solo operation keeps overhead low, decisions fast, and customer trust direct.
What it doesn't mean: that we're going anywhere. Tarsnap is solo-operated and has been for over a decade. rsync.net is family-owned and has been since 2001. Small operators outlast venture-backed companies in this niche because they don't have to grow or die.
Where the data lives
- Single datacenter:Los Angeles, US West Coast. Tier-III facility with redundant power, cooling, and network. Low latency for North American users.
- Storage backend:OpenZFS on Linux, with checksumming on every block. Snapshots and integrity verification run continuously. Bit rot on long-tenure archives gets caught and corrected.
- Network:Static IPv4/IPv6 with redundant uplinks. SFTP only — no plaintext protocols, no public file shares, no unauthenticated endpoints.
- Encryption:Client-side, AES-256, via Restic's own crypto stack. Your password generates the encryption key. We see ciphertext only.
Operating commitments
These are commitments, not aspirations. If we break any of them, you have grounds to leave with full refunds and exported data:
- 90-day shutdown notice:If ServerCrate ever shuts down, you get 90 days of advance notice with the service running normally and full export tooling available. No "service ends in 30 days" emails.
- No silent data deletion:We will never delete vault data without explicit written request from the account holder. Account suspension freezes vaults — it does not erase them.
- Standard Restic format:Your vault is a standard Restic repository over SFTP. If you ever leave ServerCrate, you can
rclone the entire repository to any other Restic-compatible target. No vendor lock-in.
- Pricing freeze for existing customers:If we raise prices, existing customers stay on their current plan rate for 12 months minimum. New customers pay the new rate. No surprise invoice changes.
- No third-party data sharing:We do not share customer metadata, vault sizes, snapshot timestamps, or login records with anyone outside ServerCrate's operation. The only exception is a valid legal process — and even then, all we have is ciphertext.
What we genuinely cannot guarantee
Honest disclosure of the things we can't control:
- Your encryption password:If you lose it, the data is mathematically unrecoverable. This is the cost of true zero-knowledge encryption. Store the password in a password manager. Print it. Both.
- Datacenter-level disaster:Single LA datacenter means a major regional event (earthquake, fire, sustained grid failure) is a worst case. Mitigation: customers should follow the 3-2-1 rule with at least one local copy. ServerCrate is your offsite — not your only — backup.
- Operator availability:Solo operation means support response targets are 24 hours, not 4. We don't claim a 99.99% uptime SLA we can't enforce solo. Status is published live at status.servercrate.net.
How to verify any of this
Trust requires verification. Here's how to check our claims yourself:
- Live status:status.servercrate.net shows real-time uptime for every public service. Operated by Uptime Kuma, separate infrastructure.
- Test the encryption claim:Provision a free vault. Upload a known file. Email support and ask us to read its contents. We will not be able to. Anyone in the support channel can verify this on demand.
- Test the export claim:Your Restic repository on ServerCrate is byte-identical to a Restic repo anywhere else.
rclone sync sftp:vault/repo other-target: moves the entire vault out. We don't have hooks that prevent this.
- Public-facing operator:Direct contact via /contact/. Same person every time. Replies come from a real human, signed.
What this page is not
This page is not SOC 2 Type II attestation. We're working toward that, but until it's certified, we don't claim it. This page is not a substitute for your own threat model — if you're storing data subject to regulatory frameworks (HIPAA, GDPR processor obligations, SEC retention), evaluate the actual requirements against what's documented here, and ask us specific questions before signing up.
This is what we can credibly commit to right now. As ServerCrate grows, those commitments grow with it — but they only get stricter, never looser.