Short answer: control inside the VPS is not control of the host
A VPS administrator can control users, files and applications inside the guest operating system. That does not, by itself, make those files invisible to the organisation that operates the virtualisation host, storage or VM backups. A provider may have technical routes to a VM image or backup. Whether a particular person is authorised to use such a route, and whether they actually have, are separate questions. Technical possibility is not evidence that Novasean staff have read customer data.
Novasean does not offer a blanket “only you can see your data” or zero-knowledge assurance. The answer for your service depends on its accepted Order, administrator roles, backup arrangement, encryption and key custody. If you need a restriction you can rely on, ask for that exact service and data flow in writing before storing sensitive information.
Which access paths matter?
There are several layers to check. An authorised guest administrator may read files and database contents through the operating system. Infrastructure administrators manage the hypervisor, VM images and storage. A VM-level backup is another copy of the virtual machine, with its own destination, retention and access controls. A support session or diagnostic export can also expose selected logs, configuration or data if you share it.
These paths are not interchangeable. Root or SSH access for you does not prove that a host operator lacks infrastructure access. Equally, a provider's technical ability to manage VM storage does not prove that every employee can browse files, that access has been used, or that every backup is readable. Ask who is granted access, for what purpose, under which approval and logging controls, rather than treating “managed”, “VPS” or “EU-hosted” as an access policy. NIST separates customer control of the guest from administrator controls at the VM, hypervisor, storage and network layers.
What encryption does and does not change
HTTPS protects data moving between a visitor's browser and the website endpoint; it does not automatically encrypt the website's files, databases or VM backups against the host operator. Storage encryption depends on where encryption happens and who controls the keys. If the customer encrypts data before it reaches a provider-controlled store and alone retains a usable decryption key, that can reduce what a stored copy reveals. You must plan key recovery and agree with the service owner how a restore will be tested.
A running application may need plaintext data and unlocked keys in its guest. Storage encryption alone therefore does not establish that the infrastructure operator cannot ever access live application data. Do not assume Novasean's included VM backup is encrypted with a key held only by you; no such service-wide assurance is published. If exclusive key custody or confidential computing is a requirement, obtain a specific agreed design and test its recovery route before placing data there.
What Novasean can currently state
For an accepted Order that incorporates the VM Start with Managed OS schedule, the VM and its included daily VM-level Proxmox Backup Server copy are specified in the Netherlands, in the same data centre. The schedule grants root access and defines customer and Novasean responsibilities. The same-site backup is not a geographically independent copy, and the schedule does not make an application-level restore or a zero-knowledge claim.
The separate client portal has a different backup path: the current location notice identifies a Canadian destination. Novasean has decided to replace that destination with EU storage, but the move has not been completed. Do not infer that your VPS backup is in Canada from the portal arrangement, or that every Novasean copy is in the EU from the VPS schedule.
Novasean's customer-control information still identifies gaps in evidence about supplier ownership, staff work locations and access to readable customer data. We therefore cannot verify an EU-only access chain or promise that no infrastructure or support operator can technically see customer content across all services. Our sovereignty and autonomy guide explains the wider position and the planned portal-backup move.
Questions to settle before hosting sensitive data
- Which service and data set? Identify the exact Order, application, database, logs and backup copies; avoid applying one service's location notice to another.
- Who can access which layer? Ask for guest, hypervisor, storage, backup and support roles; the approval, audit and incident process; and any supplier or onward access.
- Where are the copies and keys? Confirm each destination, retention window, encryption point and key custodian. Ask whether a restore can succeed if you alone hold the key.
- What can you take away? Confirm export format, switching assistance, deletion terms and a tested restore path. Your accepted Order, the applicable data processing agreement and applicable law govern your rights, not a general knowledge-base article.
Do not paste passwords, private keys or complete unredacted customer records into a routine support ticket. Agree a secure transfer method if a specific investigation needs sensitive material. If you need a contractual restriction or stronger isolation, state the requirement before ordering or changing the workload.
Frequently asked questions
Does VPS root access mean only I can read the files? No. It gives you administrator control inside the guest; it does not remove the infrastructure operator's control of the host, storage or VM backup layers.
Are Novasean's VPS backups readable only with my key? We cannot make that claim from the published VM Start with Managed OS schedule. Ask for the exact backup and key-custody design if this matters to you.
Does Netherlands hosting prove EU-only access? No. Storage location and the jurisdictions or work locations of people and suppliers with access are different facts. Novasean has not verified the complete access chain for every service.
Can I treat a support ticket as private storage? No. Share only the minimum redacted evidence needed for the issue and use an agreed secure route for sensitive material.
Sources and technical references
Related guides
Was this guide helpful?
If you accepted optional analytics, your Yes/No answer and this guide’s page address are sent to Google Analytics. No written feedback is collected. Read our privacy statement or change your choice in .
Need help with your service?
Open your client area or contact Novasean. Describe the symptom and checks you have performed. Keep passwords, recovery codes and private keys out of your message.