Vulnerabilities, advisories, and incidents — handled publicly, on the record, and on the same page as our customers. A hosting provider you can't reach during a security incident isn't a hosting provider, it's a billing service. We won't be that.
For every customer running on PrivateByte infrastructure — including Self-Managed VPS — these are the commitments we hold ourselves to when a CVE drops affecting your stack.
Security notifications go to every active customer on the affected channel(s). They are separate from marketing email and cannot be opted out of without closing your account — your server being exploitable is not a "promotional" matter.
[Security] in subject for filtering.Every advisory we've sent customers, plus upstream CVEs we're tracking even when our infrastructure is unaffected.
Found a vulnerability in PrivateByte's infrastructure, services, or portal? Email us. We acknowledge within 24 hours and aim to triage within 72.
PGP key on request. No paid bug bounty yet, but legitimate findings get written acknowledgement, public credit (with your permission), and where the impact warrants it, a meaningful gift or account credit.
The security-relevant operational principles we hold ourselves to. Implementation specifics are deliberately not enumerated here — that would only be useful to attackers — but the commitments below are real and binding.
Most hosting providers commit to nothing about CVE response in writing. Their marketing pages promise "managed" security; their legal agreements disclaim liability for the third-party software they're managing. When something critical lands, customers find out on a third-party security blog — not from their vendor.
We are, deliberately, the opposite. The commitments above are real, and customers can hold us to them. If we ever miss the SLAs on this page for a critical CVE affecting our stack, we'll publicly post that we missed and what we're doing about it — on this same page, in the advisory log. The transparency is the product.
Servers from $5.99/mo. 1 Gbps unmetered. Free DDoS protection. And a security page you can actually hold us to.