Security

Every server sits behind always-on DDoS protection at the network edge. Traffic is filtered before it reaches your server, so an attack on your IP stalls at our perimeter instead of your players. Game traffic, the dashboard and the API all travel over encrypted connections.

Team access is role-based: admins, moderators and operators each get scoped permissions, and every action is written to an audit log. Access to the control plane is limited to staff on a need-to-know basis, protected by strong authentication. Data is encrypted in transit (TLS 1.2+) and at rest (AES-256).

Backups are snapshotted off the live disk and stored in separate storage from your server. On paid plans they run hourly and restore is tested end to end, not just promised. Free servers keep daily snapshots within the product's retention window.

We apply OWASP-aligned practices in development: output encoding and parameterized queries to prevent injection, strict origin checks against CSRF, dependency scanning in CI, and a no-privileged-code policy for uploaded resources.

We monitor around the clock and page on-call engineers on anomalies. When an incident affects your data or the network, we post a public update and, where relevant, notify affected users directly. We publish postmortems for significant incidents on the changelog.

Found a vulnerability? Report it privately to security@vpsora.dev. Do not access other users' data, do not disrupt the service, and give us a reasonable window to fix before public disclosure. We thank researchers publicly (with permission) and do not pursue legal action for good-faith research within these rules.