Bu belge yalnızca İngilizce olarak mevcut Arayüz Türkçe olarak kullanılabiliyor, ancak bu belge henüz çevrilmedi. Sizden hiçbir şey gizlenmesin diye burada İngilizce olarak gösteriliyor.
Security
Practical controls for real infrastructure.
The account, platform and payment controls that exist today, what remains your responsibility, and how to reach us about a vulnerability.
No certification is claimed on this page
VdsRent does not hold, and does not display, any security certification. A certification held by an infrastructure supplier belongs to that supplier and is not inherited by us.Account security
The controls available on your account today.
Two-factor authentication
Time-based one-time codes from an authenticator application, with single-use recovery codes issued once at setup.
Session management
Every active session is listed with its device and last activity, and any of them can be revoked. No precise location is derived from an IP address.
Re-authentication
Destructive and sensitive actions — reinstalling a server, revealing a license key, disabling two-factor — ask for your password again.
Activity log
Security events are recorded against your account: password changes, new sign-ins, revoked sessions, recovery-code use.
Platform controls
How the application itself is built.
Server-side authorisation
Every private route and every mutating action is authorised on the server. Hidden navigation is never the control.
Credential handling
Passwords are hashed with a memory-hard function and a per-password salt. Initial server credentials are delivered once and never displayed again.
Secret isolation
Supplier credentials and API keys are server-only and never reach a browser bundle. Production source maps are disabled.
Request protection
Forms carry CSRF tokens, sensitive endpoints are rate limited, and redirect targets are validated against an open-redirect.
Payment security
What we hold, and what we deliberately do not.
- Raw card details never reach VdsRent systems. The payment provider handles them.
- We store a provider token and safe display metadata: brand, last four digits and expiry.
- Payment details never appear in application logs, in analytics or in support previews.
- Strong customer authentication, where the provider requires it, happens in the provider's own flow rather than in ours.
What remains yours
A self-managed server means the boundary sits at the operating system.
- Everything you install on a server, and keeping it patched.
- Firewall rules inside the operating system, and which ports you expose.
- Your own backups, beyond the backup option you have enabled.
- Access to your account: password strength, two-factor, and who you share it with.
- Lawful use of the service, as set out in the Acceptable Use Policy.
Responsible disclosure
How to tell us about a vulnerability.
A security contact address is not published yet. Until it is, use the contact form and mark the message as a security report. We do not publish a security.txt file until the contact workflow behind it exists.