Account & security

An account is an e-mail address, a password and a balance — nothing else is collected. Because we never ask for a phone number or an identity document, the way you protect your credentials matters more than on most services. This page explains the rules, the API keys, sessions, how to reach support and how to close the account.

Password rules

Passwords must be at least 10 characters. Use a passphrase or a password manager; there is no complexity rule beyond the length. You can change the password at any time under Account → Password by entering the current one.

Keep the e-mail account itself secure: it is the only channel we use for renewal reminders, DDoS notifications and support answers.

API keys

API keys let scripts, Terraform-style tooling or a CI pipeline order servers and read top-ups without your password. Generate them under Account → API keys:

• Give each key a label that says where it lives (CI runner, laptop), so you can revoke the right one later.
• The full key, prefixed cs_, is shown once, immediately after creation. Copy it into your secret store; the dashboard only shows the prefix afterwards.
• Keys have the same rights as your account. Revoke a key the moment you suspect it leaked; revocation is immediate.
• Up to 10 keys can exist at once. Calls are limited to 120 requests per minute per key.

Keys are stored hashed. If you lose a key, revoke it and generate a new one — it cannot be displayed again. Usage is documented in the API reference.

Sessions

Signing in creates a session cookie that is valid until you sign out or close the browser. There is no persistent "remember me" option: on shared or public machines, sign out from Account → Session. Changing your password does not end other sessions automatically; sign out from any device you no longer control.

The dashboard shows the time of your last sign-in. If it does not match your own activity, change the password immediately and revoke all API keys.

Sign-in protection

Sign-up and sign-in forms are protected by a Cloudflare Turnstile challenge and by rate limits per address and per account. After repeated failed attempts, further sign-ins are refused for a few minutes; wait and try again rather than retrying immediately. Turnstile is the only third-party script loaded on the site, and it runs on the authentication pages only.

Notifications

All notifications go to the account e-mail: renewal reminders 7 and 2 days before each renewal, insufficient-balance warnings, DDoS mitigation start and end, hardware replacement on dedicated servers, scheduled maintenance at least 72 hours in advance, and answers to your tickets. They cannot be turned off individually because each one concerns money or availability. Change the address by opening a ticket from the current address.

Contacting support

Open a ticket at /support — signed in, so it is attached to your account and your servers. Include the server hostname or the top-up reference, what you expected and what happened, and any error text verbatim. Tickets are answered by engineers who can act on the infrastructure, not by a first-line script. For matters that cannot go through the account (for example a lost password), write to [email protected] from the account address. Abuse reports about our address space go to /abuse or [email protected].

Before opening a ticket, check Status: incidents and maintenance affecting a whole site are announced there first.

Deleting the account

Open a ticket asking for deletion. Servers still running are cancelled and run to the end of their paid month; remaining balance is refunded under the refund policy if it is eligible, and the account with its e-mail address, sessions, API keys and tickets is removed within 30 days. Top-up and balance records are kept only as long as accounting rules require, as described in the privacy policy.

Something missing or wrong on this page? Open a ticket and tell us.