Security, Privacy & Infrastructure Access Standards
IT infrastructure you can trust
How ServerCare360 protects client data, enforces zero-credential intake, and maintains GDPR compliance for US and European infrastructure.
Zero-Credential Web Intake Policy
Our Operational Security Principles
Rigorous operational controls designed to protect production environments, prevent credential leakage, and maintain absolute confidentiality.
Zero-Credential Intake Standard
We strictly forbid transmitting root passwords, private keys, sudo credentials, or database secrets through web contact forms, live chat, or unencrypted emails. All access initiation uses secure, ephemeral exchange channels.
Ephemeral SSH Key Protocol
Our engineers connect using designated ED25519 or RSA-4096 public SSH keys provisioned directly by your sysadmin. Access is restricted to designated static operations IPs with root login disabled.
Least Privilege & Sudo Scoping
We encourage clients to grant scoped sudo privileges rather than direct root logins wherever possible. All administrative commands executed during maintenance sessions are logged via auditd and syslog.
Data Sovereignty & GDPR Compliance
ServerCare360 acts solely as a technical data processor. Your customer records, database contents, and proprietary application code remain on your infrastructure and never transit into our local storage.
Mutual NDA & DPA Agreements
We execute mutual Non-Disclosure Agreements (NDAs) and Data Processing Addendums (DPAs) before accessing production systems, establishing legally binding confidentiality terms for US and EU clients.
Isolated Engineer Workstations
Our operations workstations utilize full-disk encryption (LUKS/FileVault), enforced multi-factor authentication (MFA/2FA), hardware security keys, and strict network perimeter firewalls.
How Infrastructure Access Is Granted
Step-by-step procedure for authorizing ServerCare360 engineers safely and verifiably.
Execute NDA & DPA
Mutual Non-Disclosure Agreement and Data Processing Addendum signed to establish binding confidentiality boundaries.
Public Key Provisioning
You add our authorized engineering ED25519 public SSH key to the target server's authorized_keys with sudo privileges.
Firewall Whitelisting
If your server firewall restricts SSH ports, you whitelist our designated static operations IP block for secure access.
Audit & Logging
All commands executed are logged locally. You retain complete authority to revoke access or terminate sessions at any moment.
Common questions
Something else? Ask an engineer.
Do you store our server credentials on your servers?
No. ServerCare360 does not maintain a central database of client root passwords. Access is established via authorized SSH public keys placed in your server's authorized_keys file, or via your organization's enterprise password manager with time-based access revocations.
How do you comply with European GDPR requirements?
Under GDPR, you remain the Data Controller and ServerCare360 acts as a technical Data Processor. We execute standard contractual clauses (SCCs) and DPAs, restrict remote access to authorized engineering staff, and never extract or retain personal data from your databases.
Can we restrict your access to specific maintenance windows?
Yes. For scheduled maintenance, patching, or migrations, you can enable SSH access exclusively for the agreed window and revoke keys immediately upon completion.
What happens in the event of a suspected security incident on our server?
If our monitoring detects unauthorized access or anomalous activity, on-call engineers immediately isolate affected network sockets, capture volatile memory and log snapshots for forensic review, and alert your primary technical contact with an emergency triage briefing.
Have questions about security, compliance, or access?
Connect directly with our infrastructure leads to review your enterprise security requirements, compliance checklists, or custom access agreements.