Secure hosting is ordinary hosting designed around explicit controls: network segmentation, firewalls, DDoS mitigation, MFA for every admin path, encrypted volumes, managed keys, hardened images, a patch schedule, retained logs and backups that an attacker cannot delete. Each control has a named owner in the quote. BroadNet Cloud holds no security certifications today; where a supplier has attestations, they are shared with the quote.
What we mean by secure hosting
Most breaches of hosted systems do not start with an exotic attack on the data center. They start with a stolen admin password, an unpatched internet-facing service, a database port left open, or backups that were deleted along with production. Secure hosting is a design that closes those paths on purpose and writes down who keeps them closed.
In practice that means we start from your data and your threats, pick the hosting product that fits (VPS, cloud, managed or bare metal), and then add the controls below. Every control in the quote has three things: what it is, who operates it, and what evidence you can see that it is working.
What we do not hold. BroadNet Cloud does not hold ISO/IEC 27001 certification, a SOC 2 report, PCI DSS validation or any other security certification today. The hosting runs in established third-party data centers and cloud platforms; where those suppliers hold attestations, we share what they make available with the quote. We will not describe our service as compliant with any standard.
Who this is for, and who needs something else
A good fit
- Businesses handling customer personal data that want a defensible, documented setup.
- SaaS teams answering security questionnaires from their own buyers.
- Companies recovering from an incident who want the rebuild done with controls, not just restored.
- Anyone who wants immutable offsite backups and MFA on every admin path as a baseline.
Needs something else
- A buyer whose auditor requires the hosting provider itself to hold a certification or to be named in a service provider attestation: we cannot meet that today.
- Teams that need a managed security operations center watching alerts around the clock: we do not offer one.
- A static brochure site with no logins or personal data: shared hosting with good passwords and updates is usually enough.
The controls you can specify
Each row can be requested. Whether it is included, optional or provided by the supplier depends on the product and platform; the quote marks each one.
| Control | What it does | How it is provided |
|---|---|---|
| Network segmentation | Separates public web tier, private app tier and database tier; databases have no public address | Private networks or VLANs on the supplier platform |
| Firewalls | Default-deny inbound; only named ports from named sources | Platform firewall plus host firewall (nftables, Windows Firewall) |
| DDoS mitigation | Absorbs or filters volumetric attacks before they reach your server | Confirmed at quote depends on supplier and region |
| Admin access | MFA on every console, SSO where supported, SSH keys only, no shared accounts | Supplier console settings plus host configuration |
| Bastion or VPN | SSH, RDP and BMC reachable only through one hardened entry point | WireGuard or similar VPN, or a jump host |
| Encrypted volumes | Data at rest unreadable if a disk leaves the facility | Platform volume encryption or LUKS / BitLocker on the host |
| Key management | Encryption keys stored apart from the data, with rotation and access logs | Platform key service where available, or customer-held keys |
| Hardened images | Minimal OS with unneeded services off and secure defaults | Built against CIS Benchmark guidance |
| Patch cadence | Security updates applied on a written schedule | You, or us if managed hosting is bought |
| Logging and retention | Auth, admin and system logs shipped off the server and kept for a set period | Central log store; retention period in the quote |
| Immutable offsite backups | Copies that cannot be changed or deleted for a retention window, in a separate location | Object storage with object lock or equivalent; Confirmed at quote |
| Vulnerability scanning | Regular external and authenticated scans with a findings report | Optional; scope and frequency in the quote |
How the main controls work, and their limits
Segmentation and firewalls
The single most useful network control is that databases, caches and admin interfaces have no public IP at all. A typical layout puts a load balancer or reverse proxy in front, application servers on a private network, and the database on a further restricted network that only the application servers can reach. Firewall rules default to deny and each allowed flow has a reason written next to it.
DDoS mitigation
Volumetric attacks are handled upstream by the supplier's network, not by your server. What is available, how large an attack it can absorb, and whether it is always on or triggered varies by supplier and region, so it is written per quote. For public websites, a reverse-proxy CDN in front of the origin is often the most effective layer; we can design for one you already use.
Identity and access
Every human path into the system should use MFA, and phishing-resistant methods (hardware security keys, passkeys) where possible; NIST SP 800-63B requires phishing resistance at its highest assurance level. That covers the supplier console, the VPN, SSH (keys, ideally hardware-backed) and the BMC on bare metal. Accounts are named per person, removed on the day someone leaves, and reviewed at least quarterly. Access requests to BroadNet staff follow the identity check described on security and reliability.
Encryption and keys
Encryption at rest is only as strong as the separation between the key and the data. If the key sits on the same disk, it protects against a stolen drive but not against someone with server access. Where the platform offers a key management service, keys live there with access logging. Where you need to hold keys yourself, you keep them and we document the recovery process, because a lost key means lost data. NIST SP 800-57 is the reference for key lifecycle.
Hardened images and patching
We start from a minimal image and apply CIS Benchmark-style settings: SSH password login off, root login off, unused services disabled, time sync, audit logging on. Patching is where most setups decay. A written cadence (for example, security updates weekly, critical internet-facing fixes within days, with CISA's Known Exploited Vulnerabilities list as a priority signal) and a named owner matter more than the tool used.
Logging
Logs kept only on the server are deleted by any attacker who gets root. Ship them to a separate store that the server can write to but not erase, and keep them long enough to investigate. PCI DSS, for example, asks for at least a year of audit log history with the most recent three months immediately available. Retention is a cost line, so it is set in the quote.
Immutable and offsite backups
Ransomware operators look for backups first. A backup is only safe if the production credentials cannot delete it. Object storage with a retention lock, held in a separate account and location, meets that bar. The schedule, retention and restore test frequency should come from your recovery targets; the recovery feasibility tool checks whether they are realistic, and the backup guide covers 3-2-1 and restore tests.
Reference configurations
| Shape | Compute | Controls emphasized | Price |
|---|---|---|---|
| Hardened single server | One VPS or virtual server | Host firewall, SSH keys plus MFA VPN, hardened image, encrypted volume, offsite immutable backup | Price shown at quote |
| Segmented web application | Proxy, two app servers, database on private network | Three network tiers, platform firewall, central logs, DDoS option, managed patching | Price shown at quote |
| Single-tenant data store | Bare metal database server plus backup target | Single tenancy, LUKS with separately held keys, BMC on VPN only, media sanitization terms | Price shown at quote |
| Rebuild after incident | Fresh environment beside the old one | New credentials, clean images, verified restore, log review, then cutover | Price shown at quote |
Use cases
A SaaS product answering buyer questionnaires
Your own buyers ask where data lives, who can access it, how it is encrypted and how fast you can restore. A segmented design with a written control list lets you answer each question from a document instead of from memory. Be clear in your answers that the hosting provider itself holds no certification.
An online store that wants to keep card data out of scope
The usual approach is to never touch card numbers: use a payment provider's hosted page or fields so card data goes straight to them. That keeps most of your servers out of the heaviest PCI DSS requirements. Hosting still needs patching, MFA and logging, because a compromised store page can redirect checkout.
A professional services firm with client documents
The risk is account takeover and ransomware. MFA everywhere, no public admin panels, and immutable backups address the likely attacks better than any single product feature.
A recovery rebuild
After a compromise, restoring the old server restores the attacker's foothold. A clean build beside the old environment, fresh credentials and a verified data restore is slower but safer. Plan the cutover with the migration guide.
If you need PCI DSS, HIPAA or ISO-aligned hosting
Because BroadNet Cloud holds no certifications, a regulated buyer has to rely on two things: the supplier's own evidence for the physical and platform layers, and your own controls for everything above. Here is what to ask for and what to check, from us or any hosting provider.
| Requirement | Evidence to ask for | What to check |
|---|---|---|
| PCI DSS | The supplier's Attestation of Compliance for service providers and a responsibility matrix | That the AOC covers the exact service and locations you will use, its date, and which requirements stay with you. PCI DSS expects you to track which requirements each service provider manages. |
| HIPAA | A signed business associate agreement with every party that stores or processes ePHI | Who signs it. If a hosting party will not sign one, you cannot place ePHI there. Ask us before you buy; whether a BAA is possible is decided per quote, and if it is not, we will say so. |
| ISO/IEC 27001 | The supplier's certificate and, where shared, the Statement of Applicability | The scope statement names the facility and service you will use; the certificate is current; the certification body is accredited. |
| SOC 2 Type II | The supplier's report, usually under NDA | The audit period, the services and locations in scope, any exceptions found, subservice organizations carved out, and the complementary user entity controls you must operate. |
Supplier attestations cover the supplier's layers only. They do not make your application compliant and they do not cover BroadNet Cloud's own processes. We share what the supplier makes available with the quote, and we will tell you if a supplier does not provide a document you need.
Who is responsible for what
| Control | BroadNet Cloud | Supplier | You |
|---|---|---|---|
| Physical security, power, hardware | - | Responsible | - |
| DDoS at network edge | Arranges | Confirmed at quote | - |
| Network and firewall design we build | Responsible | - | Approves changes |
| OS patching and hardening | If managed is bought | - | Otherwise you |
| Users, MFA, keys | Configures if agreed | - | Responsible |
| Application security | - | - | Responsible |
| Backups and restore tests | If backup is bought | - | Otherwise you |
| Incident communication to you | Responsible | Notifies us | - |
The background is explained in the shared responsibility guide.
What the quote fixes in writing
- The control list, with included, optional and supplier-provided items marked.
- Who operates each control, and what you will receive as evidence (configuration export, scan report, restore test record).
- The patch cadence and maintenance windows, if we manage the servers.
- Log and backup retention periods and where copies are stored.
- DDoS mitigation scope as the supplier describes it.
- Which supplier attestations are available and how you receive them.
- How we tell you about a security incident that affects your service, and what we need from you.
- Support channels, hours and the general policy on the support page.
How buying works
- Tell us the data and the risk. Through the quote form: what data you hold, who must not see it, any standard your buyers or regulators mention.
- Agree the control list. We propose controls and owners, and say what we cannot provide.
- Receive the written quote. Supplier, region, controls, evidence available, price and terms.
- Build and hand over. We build the environment and give you the access, the configuration record and the first restore test result where backup is included.
- Review. Re-check access lists, patch status and backups on the schedule set in the quote.
Frequently asked questions
Does BroadNet Cloud hold ISO 27001 or SOC 2?
No. BroadNet Cloud holds no security certifications today. Where the data center or cloud supplier holds attestations, we share what they make available with your quote.
Can I host card payment data with you?
We can design hosting that keeps card data out of your servers by using a payment provider's hosted fields. If you must store or process card numbers yourself, ask for the supplier's service provider attestation first and check its scope with your assessor; BroadNet Cloud is not itself validated.
Will you sign a HIPAA business associate agreement?
That is decided per quote, before you buy. If we cannot sign one for your arrangement, we will say so plainly, and you should not place ePHI on the service.
Is DDoS protection included?
It depends on the supplier and region. The quote states what mitigation exists, whether it is always on, and any limits the supplier gives.
Who holds the encryption keys?
Either a platform key service with access logging, or you. Holding keys yourself gives the most control but means a lost key is lost data, so the recovery process is documented at handover.
Do you run penetration tests?
Vulnerability scanning can be added as an option. Penetration testing of your application is best done by an independent tester you choose; we will support the test window and the fixes on infrastructure we manage.
Sources
- NIST SP 800-53 Rev. 5: Security and Privacy Controls, NIST
- NIST SP 800-63B: Digital Identity Guidelines, Authentication, NIST
- NIST SP 800-57 Part 1 Rev. 5: Recommendation for Key Management, NIST
- CIS Benchmarks, Center for Internet Security
- Known Exploited Vulnerabilities Catalog, CISA
- PCI Security Standards Council document library, PCI Security Standards Council
- Business Associates (HIPAA), US Department of Health and Human Services
- ISO/IEC 27001 Information security management systems, ISO
Related
Last reviewed . Facts on this page are checked against the sources listed; anything not yet contracted is marked “confirmed at quote”.