Knowledge baseThe runbooks, in full, on one page.

Credentials appear in the client area the moment the build finishes. Nothing is emailed to you, because email is the least private channel either of us has.

1. 01
   Take the address from the client area Services → your machine. The IPv4, the port and the initial root password are on that panel and nowhere else.
2. 02
   Connect Port 22 unless you asked for another.

   ssh [email protected]

   Copy
3. 03
   Install your key and shut the door behind you Password logins are the first thing scanned for. Put your key in place, then turn passwords off.

   ssh-copy-id [email protected]
   sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
   systemctl restart ssh

   Copy
4. 04
   Check you are not locked out before you close the session Open a second terminal and log in again. Never close the first one until the second one works.

Locked yourself out anyway? Ask for a console from the client area — it is out-of-band and does not need SSH to be working.

A misconfigured firewall rule is the most common way to lose a machine, and it is entirely recoverable.

1. 01
   Request it Services → the machine → Open a console. An engineer sees the request immediately.
2. 02
   You get out-of-band access The same screen you would have standing in front of the rack, over an encrypted session. It works when the network stack is broken, when SSH is down and when the disk will not mount.
3. 03
   Fix what you broke Usually one line in a firewall or sshd config. Reboot into single-user mode from the console if you need to.

A console session is never logged as a keystroke record. What you type on it is not retained by us in any form.

A rebuild wipes the disk and reinstalls a clean image. It takes a few minutes and it is free, as often as you like.

1. 01
   Take anything you want to keep A rebuild is destructive and there is no undo. We hold no copy of your disk to restore from.
2. 02
   Request it with the image you want Services → the machine → Rebuild. Name the distribution and version.
3. 03
   New credentials appear in the client area The old root password stops working the moment the wipe begins.

The IP address stays the same across a rebuild, so DNS and firewall rules elsewhere keep working.

If you intend to send mail, this is not optional — a mismatched PTR is the single most common reason a new IP is rejected everywhere.

1. 01
   Point a hostname at the IP first The forward record has to exist before the reverse one means anything.

   mail.example.com.  A  203.0.113.10

   Copy
2. 02
   Ask for the PTR Services → the machine → Something else, and give us the hostname. Set on the same day.
3. 03
   Confirm both directions match Forward and reverse have to agree or you have achieved nothing.

   dig +short mail.example.com
   dig +short -x 203.0.113.10

   Copy

Running a Tor exit? Set a PTR that says so. It saves every operator who sees your traffic a research task, and it saves you the abuse reports that come from them guessing.

Closed by default on every new machine. Not to stop you sending mail — to stop an unattended machine acquiring a reputation the rest of the range then inherits.

1. 01
   Ask, and say what it is for One sentence is enough. We are checking that a human is behind it, not auditing your business.
2. 02
   Set your PTR before you send anything See the reverse DNS entry above. Sending first and fixing DNS later means starting your reputation in a hole.
3. 03
   Publish SPF, DKIM and DMARC All three. Two out of three is a deliverability problem you will spend a week diagnosing.

Bulk unsolicited mail is prohibited by the acceptable use policy and always will be. Transactional mail, newsletters people asked for and your own correspondence are not.

Every machine gets a /64 at no charge. Larger allocations on request, also at no charge.

1. 01
   Find the prefix On the machine panel in the client area, next to the IPv4.
2. 02
   Configure it statically Debian and Ubuntu, in /etc/netplan or /etc/network/interfaces.

   ip -6 addr add 2001:db8:1234:5678::2/64 dev eth0
   ip -6 route add default via 2001:db8:1234:5678::1

   Copy
3. 03
   Test both families A host that answers on v4 and silently fails on v6 is worse than one with no v6 at all.

   ping6 -c3 2606:4700:4700::1111

   Copy

Address space is not metered and additional addresses are not sold by the unit here.

The order of these steps is the whole point. Allow SSH before you set the default policy, every single time.

1. 01
   Allow what you need first SSH, then your services.

   ufw allow 22/tcp
   ufw allow 80,443/tcp

   Copy
2. 02
   Only then set the default Reversing these two lines is how people end up requesting a console.

   ufw --force enable

   Copy
3. 03
   Verify from somewhere else From another machine, not from the session you already have open.

   nmap -Pn -p 22,80,443 203.0.113.10

   Copy

DDoS filtering happens at the border and is not affected by anything you do here. Your firewall handles what gets through to your ports; ours handles what never reaches them.

A snapshot is a point-in-time copy on the same storage as the machine. It is excellent against your own mistakes and useless against the storage failing.

1. 01
   Take one before anything irreversible Major upgrades, migrations, that one command you are not sure about.
2. 02
   Keep the ones that matter off the box Pull them to object storage or somewhere else entirely. A backup that shares a fate with the original is not a backup.
3. 03
   Restore-test once An untested backup is a hypothesis. Restore it somewhere harmless and confirm the data is actually there.

Snapshots are stored encrypted. We hold no key to the contents of a disk you encrypted yourself, which also means we cannot rescue it for you.

S3-compatible, so every tool that speaks S3 works unmodified. Point it at the regional endpoint and use the keys from the client area.

1. 01
   Get the endpoint and keys Services → your bucket. Keys are shown once and never emailed.
2. 02
   Configure a client rclone, s3cmd, the AWS CLI, or any SDK.

   rclone config create dp s3 \
     provider=Other endpoint=https://s3.ams.dediprivacy.com \
     access_key_id=AKI... secret_access_key=...

   Copy
3. 03
   Copy something and verify it Egress is not billed, so a full restore test costs nothing but time.

   rclone copy ./backup dp:my-bucket
   rclone check ./backup dp:my-bucket

   Copy

No egress fee, no request charge, no minimum retention. The rate on the price list is the entire bill.

The strongest privacy guarantee on this platform is one we have no part in. Encrypt with a key we never see and the question of what we would hand over stops being a policy question.

1. 01
   Encrypt a data volume with LUKS Simplest on a second volume rather than the root filesystem.

   cryptsetup luksFormat /dev/vdb
   cryptsetup open /dev/vdb data
   mkfs.ext4 /dev/mapper/data

   Copy
2. 02
   Unlock it yourself at boot Over SSH after a reboot, or with a key file you keep elsewhere. Do not store the passphrase on the machine.
3. 03
   Accept the trade A reboot needs you. That is the cost, and it is the reason the guarantee is real.

Full-disk encryption with remote unlock via an initramfs SSH server is possible too. Ask for a console during setup so a typo is recoverable.

Credentials are in the client area. The licence is included in the price and is not something you have to bring or activate.

1. 01
   Connect Any RDP client: mstsc on Windows, Remmina on Linux, Microsoft Remote Desktop on macOS.

   mstsc /v:203.0.113.10

   Copy
2. 02
   Change the Administrator password immediately The initial one has been transmitted to a browser. Yours should not stay that way.
3. 03
   Move RDP off 3389 if it faces the internet The single highest-value change you can make on a Windows box.

Windows Server 2025, 2022 and 2019 images are available, and the licence is ours to worry about.

Windows machines with 3389 open are found within minutes of being switched on. Three changes remove almost all of that exposure.

1. 01
   Require Network Level Authentication It refuses the session before a login screen is ever drawn, which removes the brute-force surface entirely.
2. 02
   Restrict RDP to your own addresses Windows Firewall, scoped to the addresses you actually connect from. If they are dynamic, use a VPN endpoint on the same machine instead.
3. 03
   Rename Administrator and set a lockout policy Both are two minutes of work in Local Security Policy and both are worth it.

DDoS filtering covers the network layer. It cannot tell a legitimate RDP login from a hostile one — that part is yours.

Your account holds a balance and can order services. It deserves more protection than the machines do.

1. 01
   Use a password nothing else uses There is no identity document behind this account, which means no support agent can ever restore it for you. That is the trade you chose and it is worth respecting.
2. 02
   Turn on two-factor authentication Client area → Account. Any TOTP application.
3. 03
   Keep the account key somewhere offline It is required to confirm a withdrawal if two-factor is not enabled, and it cannot be reissued by anybody.

We hold a hash of your password and nothing else. Losing both the password and the email address on the account is unrecoverable, by design.

Allowed, including exits, on dedicated hardware. Telling us when you deploy one changes how the first abuse report about it is read.

1. 01
   Tell us it is an exit So a report about your address starts from the right assumption instead of looking like a compromised customer machine.
2. 02
   Set a PTR that says what it is Something unambiguous. Every operator who sees your traffic will look it up.
3. 03
   Publish contact details in the relay descriptor And run the reduced exit policy unless you have a reason not to.

Exits belong on their own machine, not alongside your production services. Not our rule — simply what happens when an address accumulates reports.

Usually nothing, and that is the intended answer. Filtering is always on at the border and volumetric traffic never reaches your port.

1. 01
   Check whether it is actually reaching you If your port is not saturated, the filtering is doing its job and the attack is somebody else's problem.

   ss -s; vnstat -tr 10

   Copy
2. 02
   Tell us if it is application-layer Layer 7 filtering has to understand what a normal request to your application looks like, so it is configured with you rather than guessed at.
3. 03
   Do not expect an invoice Mitigation is not metered here. An attack costs you the same as a quiet Tuesday.

We will never null-route you as a first response. If it ever came to that, an engineer would be talking to you before it happened.

Everything runs from one balance. You top it up, services draw from it, and there is no invoice to chase and no card to expire.

1. 01
   Choose an amount and an asset Minimum thirty dollars. Larger top-ups carry a bonus that is credited at the same moment as the payment.
2. 02
   Send exactly what the checkout shows The address is yours alone and is not reused. Underpayments are credited for what arrived, not rejected.
3. 03
   The balance moves on confirmation Between twenty seconds and twenty minutes depending on the chain. The table on the payments page has the figure per asset.

Balance never expires and is not withdrawn from you for inactivity.

A service draws from the balance on its renewal date. Nothing is charged before it is due and nothing renews you into a term you did not choose.

1. 01
   Keep the balance above the next charge The client area shows the runway in days and the exact date of the next charge.
2. 02
   If the balance is short You are told before the date, not after. The service is not destroyed the same hour it lapses.
3. 03
   Cancelling Services → the machine → Cancel. It runs to the end of the term you already paid for.

Longer cycles are discounted up to 35 % at twenty-four months, paid up front. The discount is applied to the whole term, not to the first month.

Not satisfied within 7 days? You can request a full refund. The 7-day period starts when the order is successfully paid. Within these 7 days, this full refund policy takes priority over the other cancellation and refund terms. Read the policy

Two situations, two different answers, both written down before you need them.

1. 01
   A service that does not work as described Refunded to the balance, in full, without an argument about how many days you used it.
2. 02
   A service you no longer want It runs to the end of the term you paid for. Prepaid multi-month terms are discounted precisely because they are prepaid.
3. 03
   A terminated account Unused balance is returned, except where termination was for one of the two prohibited categories.

Balance is returned in the asset you ask for, to an address you provide. There is no bank to send it to and no card to reverse it onto.