Is it safe to store email on a cloud based VPS host?

I know its not 100% like the unplugged server buried underground and that the Host has a big deal to do with it but, in the broader sense of avoiding snooping and data mining, how do people protect their data? I'm sure not everyone uses dedicated servers~

Is it even common to run email servers on a VPS? I DO want to be able to tell my clients that their data is relatively secure (assuming I take the proper precautions)~

I'm currently setting up email on a VPS with Ubuntu Server installed.

I'm thinking of encrypting the home folder of the email service user but, I'm wondering if accessing the encrypted data will make an imap/smtp email server slow~


The data is as safe as however much you trust the provider to keep it safe. Odds are that encrypting it on disk doesn't matter, because many common encryption schemes keep the encryption key in RAM. Anyone who gets a shell on your VM (such as a malicious IT person on your provider's side, or even a hacker) could simply log in and extract email.

More importantly, if your provider doesn't make regular backups and your server goes down for whatever reason, you could be down for hours (bad) or lose all of your clients' email (career-stunting). You'd have to make your own backups and secure those elsewhere.

"Secure" may mean something different to your clients than it does to you. This sort of thing is generally detailed carefully in a service level agreement many pages long, so if your customers are holding you to an SLA, use that as your security guideline. As a rough guideline though, the setup you're describing is not PCI-compliant.

In short, your data will not be very secure, you could lose a lot of data, and your customers' email is apparently worth up to (but not exceeding) $49.95 a month to you. Buy your own box, keep it under lock and key. Caveats on backups and malicious physical access still apply.

| improve this answer | |
  • 1
    +1 for the last line – Mark Henderson Jul 26 '12 at 2:43
  • Great, thanks! you provided some very good arguments and gave me some more things to think about. My gut was telling me its maybe not a great setup and that's why I double checked here. I will definitely rethink my email strategy. – neildaemond Jul 26 '12 at 6:34
  • I'm very glad to hear it. Please do speak directly to a colocation facility's sales team. They can tell you exactly how they do business and you can iron out a specific SLA. You do get what you pay for – Joel E Salas Jul 26 '12 at 6:53

For running my own personal vanity email domain, I find a VPS to be acceptable. Of course I am also sweeping every bit of mail off the server onto my home computer every minute via POP3.

If I were going to host other people's email, I would do so on my own physical server colocated in a data center with reasonable physical security measures in place, in addition to securing the server OS and system services.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.