Security at Serverlinx

Serverlinx accounts don't have passwords, so there's no password to reuse, guess or leak. You sign in with:

• A passkey, using your phone, computer or security key. Passkeys can't be phished, and we only ever store the public half, never your fingerprint or face.
• Google, if you prefer.
• An email link that works once and expires after 15 minutes.

We email you when your account is signed in from a new device, and you can see your recent sign-ins in account settings.

You can add an authenticator app for an extra step when you sign in with an email link. Its secret is stored encrypted, and turning it off needs a current code. Repeated wrong codes end the attempt. A passkey already counts as strong sign-in on its own.

To move your website, our engineers sometimes need access to your hosting. We protect anything you share like this:

• Encrypted on your device. Your browser encrypts it before it's sent. Our servers only ever store the scrambled version.
• The key isn't on our servers. It's held in a cloud key management service (Amazon Web Services KMS), and it can't be copied out of it.
• Only your engineer can unlock it. Only the engineer assigned to your move can view it, they have to give a reason, and it's shown for a short time only.
• Every view is logged, and you can see those views in your account.
• Deleted after your move: automatically 7 days after it's finished, or straight away if you cancel.

Wherever we can, we ask for a separate, temporary login you can remove afterwards, rather than your main one. We never ask for passwords by email, chat or phone, and we never ask you to turn off two-step sign-in at your host.

Your domain is the key to your website and email, so it stays in your hands. You make the DNS change yourself on switch-over day, with our step-by-step guide and a live checker that confirms it worked. If you move your domain registration, you use the transfer code from your registrar. If anyone claiming to be Serverlinx asks for your registrar or DNS login, don't share it, and tell us at security@serverlinx.com.

• Everything travels over encrypted connections (HTTPS).
• We store IP addresses only in a scrambled (hashed) form.
• Our team signs in to a separate admin site with a password and an authenticator app. Staff access depends on their role, and key actions are logged.
• Our servers are in London, UK. Our emails are sent through Amazon Web Services in Ireland.

If you think you've found a security weakness in Serverlinx, please email security@serverlinx.com. It helps if you include:

• the page or feature affected;
• steps to reproduce the problem;
• what you think someone could do with it.

We'll acknowledge your report, keep you updated while we fix it, and thank you publicly if you'd like. Please give us a reasonable time to fix a problem before you share it, only use accounts and data that are your own, and don't disrupt the service or other people's data. We don't currently run a paid bug bounty.

Our contact details are also published in a standard security.txt file (RFC 9116).