What we actually do

Every server is a full KVM virtual machine with its own kernel, memory and disk. It is not a container, and it is never shared with another customer.

Servers run in Gravelines, France (EU), in data centres certified to ISO/IEC 27001. We are not ourselves ISO-certified.

Server root passwords are encrypted at rest (AES-256-GCM) and shown only to the account owner.

A web console and rescue tools (root password reset, SSH key management) work even when SSH inside the server is broken.

New servers include one ScaleMax Cloud support SSH key so we can help when you ask. It is listed under Rescue → SSH keys on your server page, and you can remove it at any time; we do not log in to your server unless you ask us to or it is needed to stop abuse or a security incident.

Servers sit on a private network behind NAT.

Only the SSH port and the customer's 19 forwarded ports are reachable from the internet.

Our management traffic to the hypervisor runs over an encrypted private tunnel, not the public internet.

Network-level DDoS mitigation runs at our network edge.

HTTPS everywhere, with HSTS.

Scheduled backups run daily or weekly on every plan. The Priority Backups add-on adds hourly and 6-hourly copies.

Backups are copied every hour to offsite storage in Finland (EU), also in an ISO/IEC 27001-certified facility. A disk failure on the servers do not take the backups with it.

Restores are one click from the dashboard.

Passwords are hashed with bcrypt.

Sessions are signed, HTTP-only, secure cookies. Changing a password signs out other sessions.

Optional two-factor authentication (TOTP authenticator apps).

API keys are scoped and stored hashed.

Payments are handled by Cashfree (UPI, cards, net banking, wallets). We never see or store card numbers. How we handle account data is in the privacy policy.

Report security issues to support@scalemaxcloud.com with "Security" in the subject. We acknowledge within 2 business days. There is no bug bounty.

Public status is at /status.