How the platform is actually built.
We think you should be able to see what your systems run on, and how they are looked after when nothing is going wrong.
Owned hardware, not resold layers.
Your systems run on hardware we control and administer, with virtualisation separating tenants. There is no chain of resellers between you and the machine, which means when something needs fixing we can fix it.
Virtualisation
KVM, with each guest given its own allocated resources rather than competing for a shared pool.
ZFS storage
Every block checksummed on read, so silent corruption is caught rather than quietly replicated into your backups. Snapshots taken before changes.
Tenant separation
Web, mail and billing each run under their own accounts with their own limits, so a problem in one does not become a problem everywhere.
Two layers, and neither is trusted on faith.
Backups fail quietly. The failure is usually discovered at the worst possible moment, months later.
So the job is monitored in both directions: it alerts if it fails, and it also alerts if it simply stops running and says nothing at all.
Per-account backups
Individual sites, databases and mailboxes backed up so a single account can be rolled back without touching anything else.
Whole-system snapshots
Filesystem-consistent snapshots of the entire machine, streamed nightly to separate storage on different hardware.
Held off the platform
Backups are pulled to storage the servers cannot write to. Anything that compromises a server cannot reach through and destroy its backups.
Proven by restore
Copies are restored and compared against the original. A backup that has never been restored is an assumption, not a backup.
Checked continuously, from somewhere else.
Automated checks run every few minutes across service health, disk and storage, certificate expiry, mail queues and backup freshness. Alerting is hosted deliberately outside the platform, so an outage cannot silence the system that is meant to report it.
| Checked | Why |
|---|---|
| Service availability | Catch a failed daemon before a customer finds it |
| Storage health and capacity | Disks fill up and disks fail; both give warning if something is watching |
| Certificate expiry | An expired certificate is an outage that announces itself to every visitor |
| Backup freshness | A backup job that silently stops is worse than one that loudly fails |
| Mail queue and reputation | Queue growth is the first sign of a delivery problem or a compromised account |
| Security updates | Knowing what is unpatched is the precondition for patching it |
Assume it will be attacked, because it will.
Least access by default
Key-based SSH only, no password authentication, administrative interfaces not exposed to the public internet, multi-factor on the control panel.
Application firewall
A managed web application firewall running an industry-standard rule set in front of hosted sites, filtering the common injection and traversal attempts before they reach your code.
Blast radius contained
Per-site system users, dedicated process pools and filesystem boundaries, so a compromise of one site does not become a compromise of the server.
Watched, not just configured
Configuration drift, unexpected listening services and failed authentication are monitored, because the dangerous compromise is the quiet one.
Patched on a schedule
Security updates applied regularly and the result verified, rather than enabled once and assumed to be working.
Recoverable
Off-platform backups mean the answer to a serious compromise is a clean rebuild from known-good data, not a negotiation.
Ask us anything technical.
If there is something here you want to see evidence of before trusting us with production, ask. We would rather answer it now than have you assume.