Shared Hosting 
WordPress Hosting 
Cloud VPS Hosting 
Dedicated Servers 
Can your hosting provider see your data? Technically, yes: almost everything you store on a server is readable by whoever runs that server, unless you encrypt it before it gets there. That is true of every host, including us. What separates one host from another is what it keeps about you, who else has access to the hardware and network, and what it takes for someone to make it hand anything over.
This guide explains what a host can see on shared hosting, a VPS and a dedicated server, what encryption hides and what it does not, what hosts typically keep, who else is in the chain, the questions to ask before you buy, and exactly where Packetra stands on each point.
The short version
Your host can read your files, databases and email on shared hosting, and can reach a VPS's disk and memory through the hypervisor. Disk encryption protects data at rest, not on a running server. The only data a host cannot read is data you encrypt before it reaches the server. So choose a host by what it keeps, who else has access, and which courts can compel it, and encrypt anything that must stay private.
Can your hosting provider see your data? It depends on the plan
Can your hosting provider see your data? That depends on how much of the machine you control. The more you control, the more work it takes for the host to look inside. It never becomes impossible on hardware someone else runs.
| Plan | Who has root | What the host can reach |
|---|---|---|
| Shared and WordPress hosting | The host | Everything: files, databases, email, logs. You share the server and the host administers it. |
| VPS | You, inside the VM | The disk image and the VM's memory, through the hypervisor that runs it, plus the console. |
| Dedicated server | You | The physical machine: it can boot a rescue system or remove the drives. Full-disk encryption makes this much harder while the server is switched off. |
None of this means a host is looking. It means the ability is there, and what stops it is the host's policies, its staff's discipline and the law. A host that says it cannot see your data on a standard VPS is misunderstanding how virtualisation works or not telling you the truth.
What encryption hides, and what it does not
Encryption is the main tool for deciding how much a hosting provider can see. Which kind you use matters.
In transitHTTPS and TLS
Encrypts traffic between visitors and your server, so the networks in between see who connects but not what is said. It does nothing about data stored on the server, where your site decrypts it.
At restDisk encryption
Protects a powered-off disk, a discarded drive or a copied disk image. While the server runs, the key sits in memory so the system can read its own files, and on a VPS that memory belongs to a machine the host controls.
StrongestEncrypting before upload
Data encrypted on your own device, with keys that never touch the server, stays unreadable to the host. Encrypted backup tools such as restic and BorgBackup and end-to-end encrypted apps work this way. The catch is that a server cannot do much with data it cannot read, so this suits backups, archives and messages better than a live website.
SpecialistConfidential computing
Processor features such as AMD SEV-SNP encrypt a VM's memory so that, in Canonical's words, the workload is protected "from unauthorized access by the host operating system and hypervisor." They need specific hardware and host support, are offered mainly by the large clouds, and move your trust from the host to the chip maker rather than removing it.
What a hosting provider keeps about you
Beyond what sits on your server, every host holds records about you as a customer. These are the ones to ask about:
- Account details: at minimum an email address, often a name, address and phone number, sometimes a copy of your ID.
- Payment records: invoices and transactions, which tax law usually requires a business to keep for years. Card and PayPal payments also leave records at the payment company.
- IP addresses: from logins to the client area or control panel, used for security and fraud checks.
- Support tickets: everything you have written to support.
- Backups: copies of your data, which outlive deletions until they expire.
- Your visitors' data: on shared hosting, the web server's access logs record the IP address of everyone who visits your site. On a VPS those logs are yours to configure.
Who else can see it
Can your hosting provider see your data? That is only half the question, because your host is rarely the only party in the chain. Most hosting companies rent hardware, rack space or network capacity from others, and each of them has its own access.
- The data centre or hardware owner has physical access to the machines. If your host rents servers rather than owning them, the owner can also be approached directly.
- The upstream networks carry your traffic. They see connection metadata such as IP addresses, timing and volume, and anything sent unencrypted.
- Payment processors and domain registrars hold their own records of who paid and who registered what. Our guides to buying a VPS with crypto and anonymous domain registration cover both.
- The host's own suppliers, such as its billing system, email provider and support desk software, where your account data lives.
Who can make your host hand it over
In general, a host must comply with valid orders from the courts and authorities that have jurisdiction over it, and often over the place where the server sits. That is why the host's legal base matters as much as the server's location: a provider headquartered in the US can be reached by US authorities wherever its servers are, which our guide to hosting outside the US explains. Data centres and upstream providers can be approached too, which is one more reason to know who they are.
The rules on what authorities can demand, and what a host must retain in the first place, differ a lot between countries. Our Hosting Jurisdiction Index compares 14 of them, and our guides to Finnish hosting law and Swiss data protection law go into the two we host in.
Questions to ask a host before you buy
Can your hosting provider see your data, what does it keep, and who can compel it to share? You can ask. These eight questions cover it.
- Which legal entity runs the service, and where is it registered?
- Do you own the hardware, colocate it, or rent it, and from whom?
- What do you need from me to sign up, and do you verify it?
- What do you keep after I leave, and for how long?
- Which logs do you keep about me, and why?
- Whose court orders will you act on?
- How many legal requests have you received?
- Where does my account and billing data live?
A good host answers these plainly. Vague answers, or a privacy policy that contradicts the sales page, tell you more than any badge.
How to keep your data private from your own host
- Encrypt what does not need to be live. Backups, archives and exports can be encrypted on your machine before upload.
- Use end-to-end encryption for communication. A mail server stores messages it can read; PGP, S/MIME or an end-to-end encrypted app keep the content from the server.
- Keep secrets off the server. Password vaults, private keys and personal documents do not belong on a web server.
- Pick the plan that matches the risk. A dedicated server with full-disk encryption protects data at rest far better than shared hosting.
- Give the host less to keep. If signup asks only for an email and you pay in cryptocurrency, there is less tying the account to you.
What Packetra can see, and what we keep
We think a privacy-focused host should answer the question about itself. Can your hosting provider see your data when that provider is us? Here is where we stand.
What we can technically access
The same as any host. We administer our shared and WordPress hosting servers, our Cloud VPS plans are KVM virtual machines on hypervisors we run, and on dedicated servers we or the hardware owner have physical access. What limits that ability is policy and law, so the next three boxes are the parts that matter.
What we keep
- Signup needs an email address and a password. Other contact details are optional, and if you pay in cryptocurrency we need nothing else.
- Invoices and payment records, which Hong Kong law requires our company, ASPB Limited, to keep for at least seven years. Account and billing data is stored in our billing system on a server in Finland.
- Support tickets, and the IP addresses our privacy policy lists for security and fraud prevention.
- Backups of shared hosting, kept for up to 30 days and then deleted. When a service ends, its files, databases and email are deleted, and you can ask us to delete your account data apart from the billing records the law requires us to keep.
Who else has access
On our primary Finland network, new VPS run on hardware we own, colocated in Web1 Oy's data centre in Turku, so the data centre has physical access to the building and racks. Our second Finland network runs on servers we rent from Hetzner in Helsinki, and we are moving away from it. In Switzerland our servers are rented from an upstream provider. Wherever hardware is rented, its owner has physical access too, and every network we use is listed on our Looking Glass.
Legal requests so far
Our privacy policy commits us to acting only on valid legal requests from courts in the jurisdiction where your server is, and to not handing customer data to law enforcement voluntarily. Since launch in January 2026 we have received no court orders, in Switzerland or on our primary Finland network. On the Hetzner network we receive abuse complaints that Hetzner forwards and requires us to act on, as our acceptable use policy sets out, which is one reason we are leaving it.
FAQ
Can your hosting provider see your data on a VPS?
Technically, yes. The provider runs the hypervisor, which can read the VM's disk and memory. Whether it ever does comes down to the host's policies, its staff and the law it answers to. To take the question off the table, encrypt files before upload or use confidential computing hardware where it is offered.
Can my hosting provider read my emails?
On shared hosting, yes: messages are stored on a server the host administers, and most email is not end-to-end encrypted. To keep content private from any mail server, use PGP, S/MIME or an end-to-end encrypted service.
Does disk encryption stop my host from seeing my data?
Only while the server is off. Once it is running and the disk is unlocked, the key is in memory, which on a VPS the host can reach.
Can my hosting provider see who visits my website?
On shared hosting, yes: the web server logs visitor IP addresses, and the host runs the web server. On a VPS or dedicated server you control those logs, although the upstream networks still see connections arrive.
Can the police get my data from my hosting provider?
With a valid order from authorities that have jurisdiction over the host, generally yes. Which authorities those are, and what they can demand, depends on where the host and its servers are based.
Sources
- Ubuntu Server documentation: Confidential computing with AMD SEV-SNP
- Hong Kong Inland Revenue Department: Record keeping (Inland Revenue Ordinance, section 51C)
- Packetra privacy policy and acceptable use policy
Last reviewed: 13 October 2026
Research note: The general sections describe how hosting works technically and legally in broad terms; the details of what authorities can demand vary by country and change over time. Packetra's own figures, including the count of court orders, are as of the review date.
