Security
Security.
What we do, and what you do.
How the platform is protected, where our responsibility ends and yours begins, and what we commit to when a vulnerability affects you. Advisories are published on this page.
Last advisory 2026–05–01 · CVE-2026-31431 · Copy FailResponsibility
What we secure,
and what you secure.
A virtual private server is yours to administer. This is where the boundary sits.
Physical
Ours
Facility access control, power, cooling and the hardware itself. Servers run in access-controlled data centres, and only PrivateByte staff administer the machines running customer workloads.
PrivateByteHypervisor
Ours
Host operating system, virtualisation layer and the isolation between one customer’s server and another’s. Patched by us, on our own maintenance windows.
PrivateByteNetwork
Ours
Routing, address space and always-on DDoS protection. We also filter classes of abusive outbound traffic to keep our address reputation clean for everyone on it.
PrivateByteGuest OS
Yours
The operating system inside your server, its packages and its updates. We will always tell you when a CVE affects it; applying the fix is yours.
CustomerApplications
Yours
Anything you install and anything it exposes. We do not inspect or police what you run beyond the acceptable use policy.
CustomerAccess
Shared
We secure the control panel and account authentication. You are responsible for your SSH keys, your passwords and who you share them with.
SharedPlatform
How the platform
is protected.
Isolation
Pertenant
Between customers
Each server runs in its own virtualised environment with its own storage and its own network attachment. No shared filesystem and no shared address.
Access
2FA
On accounts and staff
Available on every customer account and required for administrative access. Administrative actions against customer services are logged.
Data
Yours
We do not read it
We do not inspect the contents of your server or your traffic. We hold what billing requires and what you give us in a support ticket.
Recovery
Daily
Backups and snapshots
Automated daily backups with seven-day retention on every plan, plus snapshots you take yourself before a risky change.
We are a UK company and handle personal data under UK GDPR · breaches affecting personal data are reported to the ICO within the statutory window, as in April 2026
Service-level commitments
When a vulnerability
affects you.
For every customer running on PrivateByte infrastructure, including self-managed VPS, these are the commitments we hold ourselves to when a CVE lands affecting your stack.
01 · Notification
≤24h
CVE notification
From disclosure to a published advisory and notice to affected customers. Critical-severity advisories go out faster.
02 · Patch
≤48h
Critical patch deploy
For software we operate — host OS, networking, the portal. Customer-managed software stays yours, but we always tell you a CVE exists.
03 · Log
Live
Public advisory log
Every notification we send also lives on this page, indefinitely. Including upstream CVEs we track even when we are unaffected.
04 · Disclosure
≤24h
Disclosure response
Found something in PrivateByte itself? You get a human reply within a business day. No bug-bounty platform in between.
Subscribe
How notifications
reach you.
The advisory log below is the record, and the Telegram channel carries every advisory as it is published. Where you need to act, we contact you directly. Security notices are separate from marketing email and are not affected by marketing opt-out.
Account email
Used when an advisory needs action from you, rather than for everything we publish.
Your account emailPortal
In-app banner
Persistent across the platform whenever your account is affected.
my.privatebyte.comTelegram
Public channel
Advisories pinned to the channel. No marketing.
@privatebyteAdvisory log
Everything we have sent,
kept where you can read it.
Every advisory we have sent customers, plus upstream CVEs we track even when our infrastructure is unaffected.
A Linux kernel bug lets an unprivileged local user escalate to root.
Hosts mitigated within 24 h. Portal patched within 48 h. No customer impact.
Customer VPS guests run their own kernels. If you are on a recent Linux, update and reboot once your distribution ships a patched kernel.
We do not run cPanel for the customer platform, so nothing of ours is exposed. If you run cPanel yourself on a VPS with us, patch through cPanel’s release channel — and we are glad to help if you want a hand.
Portal account issue. Patched same day. Reported to the ICO.
Responsible disclosure
Found something?
Tell us directly.
Send it to [email protected]. You get a human reply within one business day.
We will not threaten legal action against anyone who reports a vulnerability in good faith, gives us reasonable time to fix it, and does not access or alter customer data while proving it. If you want your name on the advisory, ask and it goes on.
Encrypt it if you want to
Plain text is fine. For sensitive findings, encrypt to the key below and verify the fingerprint out of band.
Public key — [email protected]
-----BEGIN PGP PUBLIC KEY BLOCK----- mDMEany54hYJKwYBBAHaRw8BAQdAWsdZIuY3BIXQjsD5Pvo4dcSH0m/uLUULWPz0 VBlAn/60L1ByaXZhdGVCeXRlIFNlY3VyaXR5IDxzZWN1cml0eUBwcml2YXRlYnl0 ZS5jb20+iJoEExYKAEIWIQQkBXRWGMhd6B39RB4xaTsiWnUOIAUCany54gIbAwUJ A8JnAAULCQgHAgMiAgEGFQoJCAsCBBYCAwECHgcCF4AACgkQMWk7Ilp1DiCBaQD+ KDgc4r2r+icgJP1fArgtNeu2UhV1zj6LSWctnGWfjjgA/AuXvg3TePRtJ+Zj2y4m Innqbi9Jjtk82USvAxGDIh4AuDgEany54hIKKwYBBAGXVQEFAQEHQPAya1rNqBEp vShIvnUqwsygi+rBn3KzcsiJD4Lfgik9AwEIB4h+BBgWCgAmFiEEJAV0VhjIXegd /UQeMWk7Ilp1DiAFAmp8ueICGwwFCQPCZwAACgkQMWk7Ilp1DiD4owD9ESTHC8JM jiJUP1L737BBJWMs8wP6xFJzGN5fjEHeMUQBAJ6ErARQvm/krazSMsSTVvjD1Wjg KZolW30EtEbKHEcL =n6KZ -----END PGP PUBLIC KEY BLOCK-----