How we protect your data
If one of our servers fails badly, the question that matters is simple: what do you lose? This is how we keep that answer small, and what we’re adding next. It covers the data we hold to run Vestra: your account, billing, support tickets, and the configuration of the servers that run it all.
Every night, encrypted
Every night we back up our databases and the configuration of our servers. Each backup is encrypted with age, a modern, well-reviewed encryption tool, before it leaves the machine it was made on. The places we store backups only ever see encrypted files, and the key that opens them is not kept with them.
Two copies, in two countries
Each night’s backup is stored in two places, both away from our main servers: a Hetzner Storage Box in Germany, and our standby server in Helsinki, Finland. They’re separate sites in separate countries, so a fault, fire or outage at one of them doesn’t take the backups with it. We keep 30 days of nightly backups and then delete the oldest.
A live copy in Helsinki
A backup is a picture of last night. Between backups, the standby in Helsinki keeps a live replica of our main databases (accounts, billing and the rest of the core services), updated as changes happen over an encrypted connection. If our main database server failed, we’d have a copy that is moments behind rather than hours.
A replica faithfully copies mistakes as well as good changes, which is why it sits alongside the nightly backups rather than replacing them.
Backups we actually restore
A backup that has never been restored is a hope, not a plan. Every week an automated job takes a recent backup, decrypts it, restores it into a separate, throwaway database and checks that the data is there and readable. If any step fails, we’re alerted.
Checked every day
A daily health check looks at the things that tend to fail quietly: certificates close to expiry, services that have stopped, and backups that didn’t run or didn’t reach off-site storage. Anything wrong raises an alert to the team. Separately, our monitoring watches our services around the clock, including from outside our main network, and live status is public.
Deleting means deleted, even after a restore
Under UK GDPR you can ask us to erase your account. Removing it from our live systems is the easy part. Backups are harder: restoring an older backup could quietly bring an erased account back.
So we keep a minimal record of each erasure, holding only what’s needed to repeat it. After any restore, every erasure made since that backup was taken is applied again before the restored system goes back into service. And as old backups expire, the copies in them go too: within 40 days, nothing of an erased account remains in our backups.
What isn’t covered yet
These backups protect our systems: accounts, billing, tickets and configuration. The files on your own game server or VPS are not part of them today. Until that changes, please keep your own copies of anything that matters.
Coming next: game-server backups
Update, 15 October 2026: game-server backups are now live on every plan, at no extra cost. We back up your server every day and keep the three most recent, and you can restore them yourself from the panel. You also get manual backups for a copy before a big update or a new mod pack: one on Tiny, Starter and Pro, and three on Enterprise. Databases aren’t included, so please still keep your own copy of anything you can’t replace. Details are in the changelog.
Questions about any of this are welcome at [email protected].
