Security Explained¶

Security and privacy are the whole reason this service exists. Here’s a plain rundown of the measures we run, what data we can and can’t touch, and how you can audit any of it yourself.

Security Measures¶

Here’s how we lock the doors:

• Firewall: only the ports your server actually needs stay open. Everything else is shut.
• Intrusion prevention: repeated failed logins and known bad actors get blocked automatically, courtesy of fail2ban.
• SSH hardening: the SSH daemon is locked down well past its defaults.
• OS-level isolation: Matrix components run in separate Linux cgroups and namespaces, so one can’t trample another.
• Hardened containers: the Docker containers are buttoned up too, never run wide-open.
• Single source of truth: every maintenance run wipes any manual config changes and restores our known-good setup. Yes, that means hand-edits on the server get reverted, by design.

Data Access¶

What Data Can Be Accessed by etke.cc?¶

To set up, run, and repair your server, our automation needs deep access. Technically, that means we could reach anything that isn’t encrypted:

• Any system file (due to SSH access with sudo permissions).
• Any plaintext (unencrypted) information, such as unencrypted text messages from bridged chats.

But could and do are very different things. We never read, track, trace, or spy on your data. That access exists for one reason only, to run your server and fix it when something breaks, and we use it for nothing else. (See our privacy policy for the full story.)

What Data Can NOT Be Accessed by etke.cc?¶

Anything encrypted stays closed to us: your encrypted messages, files, and everything else. We can’t read it, full stop.

Audit¶

How Customers Can Check Server Activity¶

You don’t have to take our word for any of this. Almost everything our automation does to your server is open source, on github.com/etkecc, so you can read exactly what runs.

And you can watch it happen on your own server:

• /var/log/auth.log: every login and command we run shows up here (run ls /var/log/auth.log* to see the rotated archives too).
• The Linux Audit framework: for deeper, system-call-level monitoring.