Return to Answer

When you host your data on other people's servers, then these people have full access to it.

With a virtualized server, the data is written to the hard drive of the host system. The server administrators could look at that hard drive image at any time and thus get access to the data of your users. They can also monitor the network traffic.

You could prevent access to the hard drive image by using full disk encryption. When the virtual machine encrypts all the data it writes on its virtual hard drive, that data is also encrypted when written on the physical hard drive of the host.

To prevent monitoring of network traffic, you could make sure all traffic - both administrative and user-traffic - is strongly encrypted.

But with some criminal energy, they can still monitor your data.

• When you reboot your machine, you will have to enter the disk encryption password through the remote administration console. That console is under their control, so they could use that to log your disk password.
• They can make a snapshot of your VM at any time, which dumps the whole RAM content to disk. This gives them access to all data currently in memory, including the decryption key of the virtual disk.
• When they control the VM hypervisor, they also control all the computations the virtual machines make. It's not easy to do, but it is theoretically possible to use this to break any cryptography which happens on it.

Solution: Host your servers on your own premise where you have full access.

But will Digital Ocean do that? This is what their privacy policy says:

Server Data

 

DigitalOcean does not have access to its users’ server data. The backend is locked away from the users’ support staff and only engineering staff has access to the physical servers where users’ virtual machines reside. DigitalOcean does not store users’ passwords or private SSH keys. DigitalOcean also does not request user login information to their servers. DigitalOcean does not review or audit any user data.

This is what they say. Can you trust their words? Your decision to make. By the way, their Law Enforcement Guide might also be worth reading in this regard. It describes what information they suddenly do have access to when pressed by government officials.

When you host your data on other people's servers, then these people have full access to it.

With a virtualized server, the data is written to the hard drive of the host system. The server administrators could look at that hard drive image at any time and thus get access to the data of your users. They can also monitor the network traffic.

You could prevent access to the hard drive image by using full disk encryption. When the virtual machine encrypts all the data it writes on its virtual hard drive, that data is also encrypted when written on the physical hard drive of the host.

To prevent monitoring of network traffic, you could make sure all traffic - both administrative and user-traffic - is strongly encrypted.

But with some criminal energy, they can still monitor your data.

• When you reboot your machine, you will have to enter the disk encryption password through the remote administration console. That console is under their control, so they could use that to log your disk password.
• They can make a snapshot of your VM at any time, which dumps the whole RAM content to disk. This gives them access to all data currently in memory, including the decryption key of the virtual disk.
• When they control the VM hypervisor, they also control all the computations the virtual machines make. It's not easy to do, but it is theoretically possible to use this to break any cryptography which happens on it.

Solution: Host your servers on your own premise where you have full access.

But will Digital Ocean do that? This is what their privacy policy says:

Server Data

DigitalOcean does not have access to its users’ server data. The backend is locked away from the users’ support staff and only engineering staff has access to the physical servers where users’ virtual machines reside. DigitalOcean does not store users’ passwords or private SSH keys. DigitalOcean also does not request user login information to their servers. DigitalOcean does not review or audit any user data.

This is what they say. Can you trust their words? Your decision to make. By the way, their Law Enforcement Guide might also be worth reading in this regard. It describes what information they suddenly do have access to when pressed by government officials.

When you host your data on other peoples servers, then these people have full access to it.

With a virtualized server, the data is written to the hard drive of the host system. The server administrators could look at that hard drive image at any time and thus get access to the data of your users. They can also monitor the network traffic.

You could prevent access to the hard drive image by using full disk encryption. When the virtual machine encrypts all the data it writes on its virtual hard drive, that data is also encrypted when written on the physical hard drive of the host.

To prevent monitoring of network traffic, you could make sure all traffic - both administrative and user-traffic - is strongly encrypted.

But with some criminal energy, they can still monitor your data.

• When you reboot your machine, you will have to enter the disk encryption password through the remote administration console. That console is under their control, so they could use that to log your disk password.
• They can make a snapshot of your VM at any time, which dumps the whole RAM content to disk. This gives them access to all data currently in memory, including the decryption key of the virtual disk.
• When they control the VM hypervisor, they also control all the computations the virtual machines make. It's not easy to do, but it is theoretically possible to use this to break any cryptography which happens on it.

Solution: Host your servers on your own premise where you have full access.

But will Digital Ocean do that? This is what their privacy policy says:

Server Data

DigitalOcean does not have access to its users’ server data. The backend is locked away from the users’ support staff and only engineering staff has access to the physical servers where users’ virtual machines reside. DigitalOcean does not store users’ passwords or private SSH keys. DigitalOcean also does not request user login information to their servers. DigitalOcean does not review or audit any user data.

This is what they say. Can you trust their words? Your decision to make. By the way, their Law Enforcement Guide might also be worth reading in this regard. It describes what information they suddenly do have access to when pressed by government officials.

When you host your data on other people's servers, then these people have full access to it.

With a virtualized server, the data is written to the hard drive of the host system. The server administrators could look at that hard drive image at any time and thus get access to the data of your users. They can also monitor the network traffic.

You could prevent access to the hard drive image by using full disk encryption. When the virtual machine encrypts all the data it writes on its virtual hard drive, that data is also encrypted when written on the physical hard drive of the host.

To prevent monitoring of network traffic, you could make sure all traffic - both administrative and user-traffic - is strongly encrypted.

But with some criminal energy, they can still monitor your data.

• When you reboot your machine, you will have to enter the disk encryption password through the remote administration console. That console is under their control, so they could use that to log your disk password.
• They can make a snapshot of your VM at any time, which dumps the whole RAM content to disk. This gives them access to all data currently in memory, including the decryption key of the virtual disk.
• When they control the VM hypervisor, they also control all the computations the virtual machines make. It's not easy to do, but it is theoretically possible to use this to break any cryptography which happens on it.

Solution: Host your servers on your own premise where you have full access.

But will Digital Ocean do that? This is what their privacy policy says:

Server Data

DigitalOcean does not have access to its users’ server data. The backend is locked away from the users’ support staff and only engineering staff has access to the physical servers where users’ virtual machines reside. DigitalOcean does not store users’ passwords or private SSH keys. DigitalOcean also does not request user login information to their servers. DigitalOcean does not review or audit any user data.

This is what they say. Can you trust their words? Your decision to make. By the way, their Law Enforcement Guide might also be worth reading in this regard. It describes what information they suddenly do have access to when pressed by government officials.

When you host your data on other peoples servers, then these people have full access to it.

With a virtualized server, the data is written to the hard drive of the host system. The server administrators could look at that hard drive image at any time and thus get access to the data of your users. They can also monitor the network traffic.

You could prevent access to the hard drive image by using full disk encryption. When the virtual machine encrypts all the data it writes on its virtual hard drive, that data is also encrypted when written on the physical hard drive of the host.

To prevent monitoring of network traffic, you could make sure all traffic - both administrative and user-traffic - is strongly encrypted.

But with some criminal energy, they can still monitor your data.

• When you reboot your machine, you will have to enter the disk encryption password through the remote administration console. That console is under their control, so they could use that to log your disk password.
• They can make a snapshot of your VM at any time, which dumps the whole RAM content to disk. This gives them access to all data currently in memory, including the decryption key of the virtual disk.
• When they control the VM hypervisor, they also control all the computations the virtual machines make. It's not easy to do, but it is theoretically possible to use this to break any cryptography which happens on it.

Solution: Host your servers on your own premise where you have full access.

But will Digital Ocean do that? This is what their privacy policy says:

Server Data

DigitalOcean does not have access to its users’ server data. The backend is locked away from the users’ support staff and only engineering staff has access to the physical servers where users’ virtual machines reside. DigitalOcean does not store users’ passwords or private SSH keys. DigitalOcean also does not request user login information to their servers. DigitalOcean does not review or audit any user data.

This is what they say. Can you trust their words? Your decision to make. By the way, their "Law Enforcement Guide" might also be worth reading in this regard. This is the information they suddenly can find out about you when pressed by government officials.

When you host your data on other peoples servers, then these people have full access to it.

With a virtualized server, the data is written to the hard drive of the host system. The server administrators could look at that hard drive image at any time and thus get access to the data of your users. They can also monitor the network traffic.

You could prevent access to the hard drive image by using full disk encryption. When the virtual machine encrypts all the data it writes on its virtual hard drive, that data is also encrypted when written on the physical hard drive of the host.

To prevent monitoring of network traffic, you could make sure all traffic - both administrative and user-traffic - is strongly encrypted.

But with some criminal energy, they can still monitor your data.

• When you reboot your machine, you will have to enter the disk encryption password through the remote administration console. That console is under their control, so they could use that to log your disk password.
• They can make a snapshot of your VM at any time, which dumps the whole RAM content to disk. This gives them access to all data currently in memory, including the decryption key of the virtual disk.
• When they control the VM hypervisor, they also control all the computations the virtual machines make. It's not easy to do, but it is theoretically possible to use this to break any cryptography which happens on it.

Solution: Host your servers on your own premise where you have full access.

But will Digital Ocean do that? This is what their privacy policy says:

Server Data

DigitalOcean does not have access to its users’ server data. The backend is locked away from the users’ support staff and only engineering staff has access to the physical servers where users’ virtual machines reside. DigitalOcean does not store users’ passwords or private SSH keys. DigitalOcean also does not request user login information to their servers. DigitalOcean does not review or audit any user data.

This is what they say. Can you trust their words? Your decision to make. By the way, their Law Enforcement Guide might also be worth reading in this regard. It describes what information they suddenly do have access to when pressed by government officials.