Security and compliance
What we do to every managed server, how our own access to it works, and what you should still own.
Baseline hardening on managed tiers
- SSH: key authentication only, root login by key only, password login disabled
- Host firewall: default deny inbound, with only the ports you need opened
- Brute-force blocking on SSH and, where present, on panel logins
- Automatic installation of security updates from the distribution, plus a monthly patch window for everything else
- Time synchronisation, log rotation and a remote copy of authentication logs
- Unused services disabled and listening ports reviewed at handover
The hardening checklist lists the specific settings.
How we access your server
Our administrators log in with individual SSH keys, not shared passwords. Admin actions taken through our panel and provisioning systems are recorded in an audit log. When you cancel or downgrade to Unmanaged we remove our keys and monitoring agents and confirm it in writing.
Backups
Managed backups are encrypted on your server before they leave it and are stored in a different facility. Encryption keys are held separately from the backup storage credentials.
Physical and network
Servers are single-tenant hardware in access-controlled data centers. Every server sits behind automatic network-layer (L3/L4) DDoS filtering. Application-layer protection (a WAF or CDN) is not included and is worth adding for public web applications.
Compliance
Execore Hosting does not claim any certification of its own. If you are working toward SOC 2, HIPAA, PCI DSS or similar, a single-tenant managed server can be part of that environment, and we can document our controls for your auditor. Ask before ordering so we can confirm whether a specific facility attestation or a business associate agreement is available for your case.
Shared responsibility
You own application security: your code and its dependencies, user accounts in your software, secrets in your configuration and who you give access to. We own the operating system baseline on managed tiers and the hardware on every tier.
Reporting a vulnerability
This covers ExecoreHosting.com and its order and contact forms, which we own and operate. Problems on a customer's server go through the abuse page instead.
Email [email protected] with the subject "Security report", the steps to reproduce the issue, what an attacker could do with it, and how to reach you. We acknowledge reports within two business days, keep you informed while we fix it, and credit you if you would like.
Rules for testing:
- Use only accounts you own, or test accounts we give you.
- Stop at the minimum needed to show the issue. Do not view, change or keep other people's data.
- No denial-of-service testing, spam, social engineering or physical attempts.
- Give us 90 days to fix the issue before you disclose it publicly, unless we agree on a different date.
If you make a good-faith effort to follow these rules, we consider your research authorized under the Computer Fraud and Abuse Act and similar laws, we will not bring legal claims against you for it, including under the anti-circumvention provisions of the DMCA, and we will say so if anyone else does. This covers only systems we own and operate. We cannot authorize testing of services run by others, such as our payment processor. If your research exposes personal information, we may have to report the incident to authorities or to the people affected. Our contact details are also published at /.well-known/security.txt.