Every host makes claims about security. Ours are in
how secure is Virtbase: disks encrypted with
LUKS2, hosts locked at boot with TPM and BIOS passwords, everything over TLS.
The difference is what happens when you want to check. With most providers the
answer is a trust-me page and a compliance badge. Here you can open the
repository and read how a session is issued, how an API key is verified, what a
backup actually does and which fields we store about you.
That is worth more than any badge, and it is uncomfortable in a way that keeps
us honest. Code that anyone can read is code you have to be able to defend.
You can audit the parts that touch your data before you trust them with it —
authentication, the firewall rules we apply, what the Discord bot is allowed to
do on your behalf.
You can also fix things. If you hit a bug, an issue on the tracker goes to the
same people who write the code, and a pull request is a legitimate way to get a
feature you need. Several parts of the product exist because someone asked for
them in the open.
If you find a security problem, please report it privately to
support@virtbase.com rather than in an issue. We
acknowledge within 48 hours
and compensate responsible disclosure.
Virtbase runs in English, German, French and Dutch, and the translations live on
Crowdin rather than in a vendor's black box.
If your language is missing, or a string reads like it was translated by a
machine, you can fix it yourself. That is not a small thing for a product where
the wrong word in a firewall dialog costs somebody an afternoon.