Network DDoS filtering
Volumetric and protocol attacks are filtered at the network edge before they reach your server. Always on, in all six regions, on every plan, at no extra cost.
Hosting security you can check.
How we protect the infrastructure under your sites, which parts are yours to look after, how we handle personal data under the DPDP Act, and how to report a vulnerability. Plain answers, including where the limits are.
DDoS filtering on every plan
Data stays in your region
Reports acknowledged in 3 business days
Hosting security: eight layers between an attack and your data.
From the network edge down to the backup copy, on infrastructure backed by our 99.99% uptime SLA. Each layer assumes the one before it might fail.
Firewalls and a web application firewall
Firewalls on our hosting servers, plus WAF rules and brute-force protection that stop common attacks on WordPress, WooCommerce and other apps. On a VPS, the firewall is yours to set.
Account isolation
CloudLinux gives every shared account its own resource limits and a caged file system. Each VPS is a separate KVM machine; dedicated servers are yours alone.
Malware scanning and cleanup
Imunify scans files on hosting accounts, quarantines infected ones and cleans what it can. We tell you what was found and where.
Backups and restore
Daily backups on Orbit and above, weekly on Launch, and an add-on for VPS. Restore a file, a database or a whole account yourself. See the backup schedule
Access control
Two-factor sign-in for the client area and SSH keys on VPS. Staff access follows least privilege: named accounts only, granted per task and logged.
Patching
Operating system, control panel and PHP security updates are applied on a regular schedule, and critical fixes out of band. Reboots are announced on the status page.
TLS everywhere
Free AutoSSL on every hosting domain, renewed automatically. Our website and client area are HTTPS-only. Paid DV, OV and EV certificates start at ₹799/yr.
Shared responsibility
Who looks after what, product by product.
Security is split between us and you, and the split moves with the product. The more control you take, the more of the stack is yours to patch and watch, starting with how you secure a new Linux VPS.
| Layer | Web, WordPress & reseller hosting | VPS, self-managed | VPS, fully managed | Dedicated server |
|---|---|---|---|---|
| Facilities and physical access | Us | Us | Us | Us |
| Network and DDoS filtering | Us | Us | Us | Us |
| Hardware and hypervisor | Us | Us | Us | Us |
| Operating system updates | Us | You | Us | You |
| Control panel and server software | Us | You | Us | You |
| Firewall rules | Us | You | Shared | You |
| Malware scanning | Us | You | Shared | You |
| Backups | Shared | Shared | Shared | You |
| Your apps, plugins and code | You | You | You | You |
| Passwords, 2FA and who has access | Shared | Shared | Shared | Shared |
| The data you store | You | You | You | You |
Want us to carry more of it? The Fully managed add-on (₹999/mo on a VPS, ₹2,999/mo on a dedicated server) moves OS updates, control-panel upkeep and hardening to our engineers. Support plans
On hosting, backups are "shared" because we run them and you restore from them, and because a copy of anything critical should also live somewhere you control.
Your data under the DPDP Act 2023.
We follow the Digital Personal Data Protection Act 2023 and the DPDP Rules 2025. Here's what that means for the data in your account and the data you host with us.
- 01
Your region stays your region
Each service's data stays in the region you choose when you order. We don't move it to another country without asking you first.
- 02
India regions for Indian data
Mumbai and Delhi NCR keep sites, databases and mailboxes in India. Business email is offered only from these two regions.
- 03
Two roles, clearly split
For your account and billing details, we are the data fiduciary. For the content you host, you are, and we process it only to run the service you bought.
- 04
Named processors only
Account data goes only to the processors needed to run the service: payment gateways, email delivery, data-centre partners and domain registries. See the list
- 05
Retention you can predict
Service data is deleted 7 days after a service ends. Billing records are kept as tax law requires, and KYC records for VPS and dedicated orders for 5 years after the service ends, under the CERT-In Directions of 28 April 2022.
Backup policy
How many restore points each plan keeps.
Each block below is one restore point. Hosting and WordPress backups are included in the plan price; on a VPS they are an add-on.
LaunchWeb hosting
Weekly4 copiesOrbitWeb hosting
Daily7 daysGalaxyWeb hosting
Daily14 daysUniverseWeb hosting
Daily30 daysWP StarterWordPress hosting
Daily14 daysWP Pro & BusinessWordPress hosting
Daily30 daysBackups add-onVPS · +20% of the plan price
Daily14 days + 3 free snapshotsDedicated serversBare metal
Not included—Plan your own backups; we're happy to advise on a setup that fits.
Restore it yourself. Files, databases and mailboxes can be restored from cPanel in a few clicks. How to restore
A safety net, not an archive. Backups roll over as new ones are taken. Keep your own copy of anything you can't afford to lose.
Four steps, with CERT-In's 6-hour deadline built in.
Detect, contain, notify, review: every security incident goes through the same steps in the same order, with the legal reporting deadlines written into step three rather than remembered at the last minute.
-
01 · Detect
Spot it early
Monitoring on every region and service, plus reports from customers and researchers to security@.
-
02 · Contain
Stop the spread
Isolate affected systems, close the attack path and preserve logs for the investigation.
-
03 · Notify
Tell the right people
Report to CERT-In within 6 hours, as its Directions require. Tell affected customers without undue delay, and post on the status page within 15 minutes of confirmed impact.
-
04 · Review
Learn from it
Find the root cause, fix it everywhere it applies, and publish a written post-mortem for major incidents.
If an incident affects personal data you host with us, we tell you promptly so you can meet your own duties as the data fiduciary under the DPDP Act.
Responsible disclosure
Found a vulnerability? Tell us first.
We welcome reports from security researchers and customers. If you follow the rules below in good faith, we'll work with you, fix the problem and credit you if you'd like.
In scope
- virtualcloud.in and the subdomains we operate
- The client area, billing and checkout
- Our nameservers and DNS service
- Control-panel configurations and server images we provide
- Our APIs and the VPS console
Out of scope
- Customer websites and servers on our network: use report abuse
- Denial-of-service or load testing
- Social engineering, phishing or physical attacks
- Automated scanner output without a working proof of concept
- Missing headers, SPF/DMARC or clickjacking on pages with no sensitive actions
- Bugs in third-party software we don't control; please tell the vendor
Rules of engagement
- Test only against accounts you own or have permission to use.
- Access only the data you need to show the problem. Don't view, change or delete anyone else's data.
- Stop and report as soon as you've confirmed the issue. Don't pivot further into our systems.
- Give us reasonable time to fix it before going public. We suggest 90 days and will agree a date with you.
Safe harbour
If you act in good faith and within this policy, we will treat your research as authorised, we will not pursue legal action against you, and we will not ask law enforcement to investigate you for it. If someone else does, we'll make it clear that you followed this policy.
Documents for your security review.
Tell us what your procurement or compliance team needs and we'll send what we can, in writing. Some documents are shared under a non-disclosure agreement.
- Facility certificationsIssued to our data-centre partners, not to VirtualCloud
- Security questionnairesYour vendor-assessment form, answered by our engineers
- Data processing termsHow we process the personal data you host with us
- Processor listPublic, in our privacy policy
FAQ
Security FAQs: certifications, data location and staff access.
Something else on your mind? Email security@virtualcloud.in.
We don't claim certifications we don't hold. The data-centre facilities we use are run by operators with their own certifications, and we can share copies on request through the documents form. This page describes the controls we run ourselves.
In the region you choose when you order, and only there. Choose Mumbai or Delhi NCR to keep it in India. Business email is offered only from those two regions. See what runs where.
On web, WordPress and reseller hosting, yes: Imunify scans your files, quarantines infected ones and cleans what it can. On a self-managed VPS or dedicated server you choose your own tools; with the Fully managed add-on our engineers set them up for you.
Only when there's a reason to: fixing something you've asked us to fix, keeping the platform secure, or meeting a lawful order. Staff use named accounts with only the access their role needs, and that access is logged.
Sign in to the client area, open your account's security settings and enable two-factor authentication with an authenticator app. We recommend it for every account, especially for anyone who can pay invoices or manage domains.
Use the report abuse form or email abuse@virtualcloud.in with the IP address, timestamps and evidence. Abuse by a customer is handled under our acceptable use policy; security@ is for vulnerabilities in our own systems.
Send us your security questionnaire.
Security reviews, questionnaires and awkward edge cases are all welcome. We'll answer in writing.