Security and compliance
What we do to every managed server, how our own access to it works, and what you should still own.
Baseline hardening on managed tiers
- SSH: key authentication only, root login by key only, password login disabled
- Host firewall: default deny inbound, with only the ports you need opened
- Brute-force blocking on SSH and, where present, on panel logins
- Automatic installation of security updates from the distribution, plus a monthly patch window for everything else
- Time synchronisation, log rotation and a remote copy of authentication logs
- Unused services disabled and listening ports reviewed at handover
The hardening checklist lists the specific settings.
How we access your server
Our administrators log in with individual SSH keys, not shared passwords. Admin actions taken through our panel and provisioning systems are recorded in an audit log. When you cancel or downgrade to Unmanaged we remove our keys and monitoring agents and confirm it in writing.
Backups
Managed backups are encrypted on your server before they leave it and are stored in a different facility. Encryption keys are held separately from the backup storage credentials.
Physical and network
Servers are single-tenant hardware in access-controlled data centers. Every server sits behind automatic network-layer (L3/L4) DDoS filtering. Application-layer protection (a WAF or CDN) is not included and is worth adding for public web applications.
Compliance
IFHosting does not claim any certification of its own. If you are working toward SOC 2, HIPAA, PCI DSS or similar, a single-tenant managed server can be part of that environment, and we can document our controls for your auditor. Ask before ordering so we can confirm whether a specific facility attestation or a business associate agreement is available for your case.
Shared responsibility
You own application security: your code and its dependencies, user accounts in your software, secrets in your configuration and who you give access to. We own the operating system baseline on managed tiers and the hardware on every tier.
Reporting a vulnerability
Email support@ifhosting.com with the details. We acknowledge reports within two business days.