Trust isn't a marketing word.
Here's what we actually commit to.

Who runs ServerCrate

ServerCrate is run by a small, deliberately lean engineering team. We handle every part of the stack ourselves - infrastructure, customer support, billing, the website you're reading - because that's how trust gets built and decisions stay fast. It's a deliberate choice, not a stage-one startup waiting to scale into something more impersonal.

What it doesn't mean: that we're going away. Tarsnap has operated as an independent specialist for over a decade. rsync.net is family-owned and has operated since 2001. Independent specialists in this niche outlast venture-backed companies because they don't have to grow or die.

Where the data lives

• Single location:Los Angeles, US West Coast. Owned hardware with redundant power and a business-grade network uplink. We are not a multi-region datacenter and do not claim to be. Low latency for North American users.
• Storage backend:OpenZFS on Linux, with checksumming on every block. Snapshots and integrity verification run continuously. Bit rot on long-tenure archives gets caught and corrected.
• Network:Static IPv4 and IPv6 on a business-grade uplink. HTTPS only - no plaintext protocols, no public file shares, no unauthenticated endpoints.
• Encryption:Client-side, AES-256, via Restic's own crypto stack. Your password generates the encryption key. We see ciphertext only. ServerCrate Backup is encrypted in your browser the same way, and Proxmox Backup Server and Borg backups are too when you keep their encryption on. Cloud servers and hosted websites are not zero-knowledge.

Operating commitments

These are commitments, not aspirations. If we break one, you can cancel the affected service, take your data with you, and we refund the unused part of any prepaid period, as section 5 of our Terms of Service provides:

• 90-day shutdown notice:If ServerCrate ever shuts down, you get 90 days of advance notice with the service running normally and full export tooling available. No "service ends in 30 days" emails.
• No silent data deletion:We never delete a paid service without warning. When a service ends through cancellation or non-payment, it is suspended first, we email you before its grace period runs out, and paying or resubscribing during the grace period restores it. Free vaults that never received a backup are paused, not deleted. The full rules, including what happens after a chargeback, are in sections 6, 7 and 11 of our Terms of Service.
• Standard Restic format:Your vault is a standard Restic repository. If you ever leave ServerCrate, you can restic copy the entire repository to any other Restic-compatible target. No vendor lock-in.
• Pricing freeze for existing customers:If we raise prices, existing subscribers keep their current rate for as long as the subscription stays active. New customers pay the new rate. No surprise invoice changes.
• No data sharing beyond running the service:We do not sell or share customer data. The only outside companies that receive personal data are the ones on our sub-processor list, each limited to what its task needs, and we give 30 days' notice before adding one. Beyond that, we disclose data only under valid legal process, and for restic vaults all we have is ciphertext.

What we genuinely do not guarantee

Honest disclosure of the things we don't control:

• Your encryption password:If you lose it, the data is mathematically unrecoverable. This is the cost of true zero-knowledge encryption. Store the password in a password manager. Print it. Both.
• Site-level disaster:A single LA location means a major regional event (earthquake, fire, sustained grid failure) is a worst case. Mitigation: customers should follow the 3-2-1 rule with at least one local copy. ServerCrate is your offsite - not your only - backup.
• Support response:At our current scale, support response targets are 24 hours, not 4. We commit to 99.5% monthly uptime on paid services, with account credits when we miss it (see our Uptime Credit Policy), and we don't claim a 99.99% SLA we could not back at this size. Status is published live at status.servercrate.net.

How to verify any of this

Our public artifacts live on the downloads page: the open-source restic-toolkit, our PGP signing key (for verifying release signatures and the warrant canary), and the signed canary statement itself.

Trust requires verification. Here's how to check our claims yourself:

• Live status:status.servercrate.net shows real-time uptime for every public service. Operated by Uptime Kuma.
• Continuous restore verification:Every 15 minutes, a machine on separate infrastructure - a VPS in another region, independent of our backup nodes - exercises the entire customer path: it backs up a canary file through the same public endpoint you use, restores it, and byte-compares the result. A failed restore pages us before it could ever reach you. This proves the pipeline restores end-to-end; it never reads your data - your own test restore does that.
• Test the encryption claim:Provision a free vault. Upload a known file. Email support and ask us to read its contents. We will not be able to. Anyone in the support channel can verify this on demand.
• Test the export claim:Your Restic repository on ServerCrate is byte-identical to a Restic repo anywhere else. restic copy from your vault to another backend moves every snapshot out. We don't have hooks that prevent this.
• Direct human contact:Reach us via /contact/. Replies come from the same small engineering team, no outsourced front line.

What this page is not

This page is not SOC 2 Type II attestation. We don't hold one, and we won't claim it until it's actually certified. This page is not a substitute for your own threat model - if you're storing data subject to regulatory frameworks (HIPAA, SEC retention and similar), evaluate the actual requirements against what's documented here, and ask us specific questions before signing up. For GDPR and US state privacy laws, our Data Processing Agreement sets out our obligations as your processor.

This is what we can credibly commit to right now. As ServerCrate grows, those commitments grow with it - but they only get stricter, never looser.

Subprocessors

A few outside services receive the operations, payment, domain or phone data their task needs. None of them can access your backups: those stay on our own hardware, and vault backups are encrypted before they leave your machine.

• Cloudflare: Turnstile bot check on the portal sign-up form only, loaded when someone starts filling it in. Sees IP address and browser signals.
• Discord: our team's internal alert channel. Sees operational alerts with masked email addresses and truncated IP addresses only.
• Openprovider: domain registration, for domain customers only. Sees the registrant details registries require.
• Stripe: card payments. Sees email, billing and card details (we never see full card numbers).
• VoIP.ms: phone verification and opt-in text messages. Sees phone number and message text.

PayPal processes PayPal payments as an independent company, not on our behalf. Network carriers only transmit traffic. The full list, with locations and transfer mechanisms, is on our sub-processor page, and we give 30 days' notice there and by email before adding a subprocessor. Email, our customer portal, security monitoring and backup storage run on our own hardware in Los Angeles, not on third-party clouds. Our one off-site system is a watchdog server that checks our public services and holds no customer data.

Requests

To report a security issue, email security@servercrate.net (details in our security.txt). You can download an export of your account data from the Security page in the portal. To delete your data or ask for anything else, email privacy@servercrate.net from the address on your account and we will handle the request within 30 days.