Security Policy

Security

Updated: 13 July 2026

Disrupting the signal of centralised control is the mission that drives Noiz. Scrutinised and well-considered security processes are a critical part of delivering every service.

This document aims to provide information and reassurance regarding the appropriate technical and organisational measures we have in place to protect our clients’ data, information and intellectual property, and should be read in conjunction with our Terms of Service, Privacy Policy and Data Processing Agreement.

We don’t provide individual audits or highly detailed information regarding security queries for our web hosting and dedicated server product range.

Table of Contents

• 1. Physical Security
• 2. Network Security
• 3. Monitoring
• 4. Platform Security
• 5. Other
• 6. Customer Responsibilities

1. Physical Security

1.1. Location

Our physical server hardware is hosted at Blacknight’s data centre in Dublin, Ireland. Cloud capacity runs in Hetzner facilities in the EU, located in Germany and Finland.

The following applies to our primary data centre in Dublin; similar standards and measures apply at the EU cloud facilities we use.

1.2. Surveillance

The data centres we use are professionally operated facilities with 24/7 physical security, access control and surveillance.

1.3. Access Control

Physical access to the data centre floor is restricted to authorised personnel and is controlled by the facility operator’s access-control systems. Noiz staff and contractors are granted access only where operationally required.

1.4. Fire Prevention

The facilities are designed and operated to reduce fire risk, with smoke detection and fire-suppression systems appropriate to a data centre environment.

1.5. Power Outages

The facilities provide redundant power feeds, with UPS and generator backup to keep mission-critical infrastructure such as IT load, air conditioning and security systems running in the event of a utility power failure.

1.6. Connectivity

The facilities are served by multiple upstream network providers over diverse, redundant routes. Should a network failure occur, traffic is rerouted via alternate uplinks, providing resilience against the failure of any single link or provider.

2. Network Security

Network-level protection is provided by the data-centre operators and supplemented by controls Noiz manages directly:

• DDoS mitigation — the facilities Noiz uses provide automated network-level DDoS detection and mitigation, filtering attack traffic before it reaches customer systems.
• Network segmentation and anti-spoofing — customer systems are segmented, and provider-level anti-spoofing controls limit source-spoofed and cross-segment traffic.
• Firewalling — firewall rules at the network edge and on each host rate-limit and block abusive protocols, restrict management access to defined source addresses, and block known-abusive hosts.

3. Monitoring

All servers managed by Noiz are monitored 24/7 for all critical services and hardware health. Our reactive system administrators react to monitoring alerts as they are identified and escalate issues to data centre staff or platform engineers.

4. Platform Security

4.1. Servers

All servers used to provide our managed hosting service, both for shared web hosting and dedicated managed servers, are physical servers exclusively provisioned and managed by Noiz. Our Self-managed servers are provisioned by Noiz, while the software is maintained by the customer.

Servers are designed to provide redundancy and reliability. They include multi-core, multi-CPU systems, ECC (Error-Correcting Code) memory modules to detect and correct data corruption in real-time, and enterprise-grade storage that includes hard disks and solid-state drives. All data is stored on dedicated, robust RAID storage arrays providing data redundancy and integrity. Additionally, servers in our Self-Managed range include a Battery Backup Unit (BBU) which protects and maintains the data on RAID cards.

4.1.1. Security Response Policy

• All relevant security advisories are evaluated weekly. We make use of Debian Linux and trust their security response (https://www.debian.org/security/) to all CVEs (https://cve.mitre.org).
• Note: Debian is a slow moving distribution, which means that versioning misinterpretation regarding security vulnerabilities may occur when looking at the output of a typical automated security scan. Debian doesn’t upgrade major versions for any releases once they moved into the stable release phase, but they do apply security patches. Therefore, it may appear that the old stable release of Debian is running an insecure version of certain software packages e.g. OpenSSL (1.0.1t-1). However, the vulnerability is addressed once the Debian patch version is applied (1.0.1t-1+deb7u3). This indicates the Debian maintainer’s ongoing commitment to patching security-related issues on all supported versions of Debian.
• We are committed to updating all software to the latest stable versions within 7 days of their release, and within 24 hours for critical software updates.

4.1.2. Remote Access

• Access to managed servers is limited by means of Linux firewall software. All managed servers make use of the same incoming firewall rules, and we do not allow any deviation from the standard rulesets

4.1.3. Backups

• All Noiz Managed Servers (i.e. Web hosting and Managed Servers) are automatically backed up in the early hours of the morning. The backup includes all critical data required for disaster recovery.
• Backups are made of the user’s home directory as well as databases. The user’s home directory will include site content, web logs and any mail that was on the server at the time that backup was completed.
• Clients can restore up to the previous 2 weeks of backup data via the Noiz Control Panel. Please note that Noiz does not guarantee backups. If you have critical data which you cannot afford to lose in the event of a disaster, keep a copy of your data locally (or at an alternate location) as well.
• Logs (such as FTP, web server and mail logs) are normally kept for 60 days.
• Due to the large scale of our Web hosting and Managed server hosting environment, our backup and restore process is effectively tested on a daily basis.

4.2. Software Development

Stack: We have a strong focus on open source technologies and mainly use PHP and Ruby as our backend languages. Our frontend stack comprises HTML/HTML5, CSS/CSS3 and various JavaScript frameworks. We use varying database technologies, including MySQL, MariaDB and Postgres.

Coding Practices: We follow an Agile development methodology and use best practices and industry-standard secure coding guidelines to ensure security is always at the top of our minds. Security controls are reviewed on an ongoing basis, and independent external testing is engaged where appropriate.

4.3. Anti-Virus

All servers (which are Linux-based) run Clam anti-virus, which is updated as new virus definitions are released. Servers are scanned daily.

4.4. User Passwords

All customer passwords are stored in a one-way encrypted format. Noiz is not able to retrieve any passwords. Due to the broad technology implementation across our hosting software and platform, we employ a number of different password hashing algorithms e.g. bcrypt, sha-512. We implement industry standard practices for mitigating various password cracking methods e.g:

• Password salts to mitigate rainbow attacks
• Multiple password hashing rounds (key stretching) to massively draw out brute force attacks

4.5. Mail Security

SSL is used for POP, IMAP and SMTP protocols for email, resulting in data encryption between our server and clients’ mail programmes. The use of strong passwords is enforced when creating or editing mailboxes via the mail admin tool.

The following measures are used to mitigate spam and malware:

• Anti-virus and anti-spam scanning occurs on all inbound and outbound email.
• Common malicious file extensions are blocked for both inbound and outbound email.
• Known malicious IP addresses are blocked by our firewall for incoming email.

4.6. Data Protection

Data protection includes security and is a related topic.

4.6.1. Payment Data Security

Credit or debit card purchases for Noiz services are processed by a third-party vendor. No account details are submitted via our website or stored on our systems. Various authentication measures and system firewalls secure banking details for debit order instructions.

5. Other

5.1. Incident Response

We have good incident response plans, procedures and practices in place which mean we respond to incidents or data breaches quickly and effectively.

5.2. Trust and Safety Team

Our dedicated team of trust and safety consultants monitor the hosting platform for any form of abuse such as compromised websites and mailboxes, network abuse and phishing attacks and take swift remedial steps. They also contribute towards adapting our systems to current trends in spam to ensure that our spam filtering service is effective.

5.3. Accreditation

Noiz has not undertaken the SOC 2 or ISO 27001 accreditation, though we fully support the Trust Service Principles (TSP) of security, availability, processing integrity, confidentiality and privacy. We commit to security, best business practices and continuous improvement.

6. Customer Responsibilities

While we care for the hosting infrastructure, including the network and servers, our clients are responsible for keeping their data and hosting accounts secure.

• Use secure passwords and store them safely
• Ensure sufficient security for your web applications
• Ensure that CMS’ and plugins are always kept up-to-date
• Self-managed clients need to administer and security patch their own OS and applications, firewalls, etc as Noiz is responsible for the hardware and they are responsible for their software.

We remain committed to providing a reliable hosting service to businesses that are serious about uptime, and technical support, and are looking to benefit from evolving open source technologies.