Security at Astroworld

The short answer

• Two step login
• 15 rights
• Nightly backups
• DDoS filtering
• 31 AI checks

Your account is the key to everything else

One account holds your files, your live console, your backups and your billing. That is convenient right up to the moment somebody else has the password, which is why two step verification is the first thing to turn on and the last thing to skip.

You set it up in your dashboard with any authenticator app, and you get eight backup codes for the day the phone is gone. A backup code works once and is used up the moment it works. Signing in with Google does not route around the check: with two step verification on, the dashboard and the panel stay closed until the code is right.

Rights, one at a time, instead of a shared password

A co-owner who needs the console does not need your billing, and a builder who needs the file manager does not need the power button. You invite people by email address and give them exactly the rights you meant: fifteen of them, with four roles to start from, and a short list of things that stay with the owner forever.

All 15 rights, what each one really covers, and what only you can do

The copy that undoes the evening

Most security incidents on a Minecraft server are not break ins. They are a griefer with build rights, a plugin that ate the world, or a config change nobody can undo by hand. All three are solved by the same thing: a copy from before it happened.

A backup is taken for you every night, on every plan, and one you press yourself comes on top of that. You hold 10, the oldest moves to a bin that keeps it 7 more days, and you can lock the copy from before a big update so the rotation never removes it. Restoring is one click with the server stopped; downloading gives you the same archive on your own disk.

How the nightly backups work, and how many you keep

What stands in front of the machine

DDoS protection is active on every server in every location. Layer 3, 4 and 7 attacks are filtered upstream, before they reach your instance, and it is part of the infrastructure rather than a box you tick at checkout. There is no protection add-on to buy here, because a server that only survives an attack when you paid extra is not a server that survives an attack.

The check that looks at your own server

The security assistant in the panel runs 31 checks against your real files rather than against a general checklist: server.properties, the operator list, the whitelist, the bans, what is in your plugins or mods folder, the tail of the log, and our own records for two step verification and staff rights. Every finding comes back as critical, warning or passed, with what to do about it.

It reports, it does not quietly repair. The Copilot works inside a fixed set of safe actions: it cannot run arbitrary commands, it cannot install software outside the vetted catalog, and it cannot change security, account or billing settings. Anything it prepares is shown to you and applied only when you approve it.

All 31 checks, and what the AI is never allowed to change

Your files, and what happens at the end

After a cancellation or a renewal that is not paid, your server files stay available for 7 days so you can download them through the panel. After those seven days the data is permanently deleted. What we keep about you as a customer, and for how long, is on Privacy, and what is not allowed on a server here is on Acceptable use.

Whether it is up, and what we promise

Security and availability are different questions, and both have their own page. Every part of the service is checked on its own line and the figures are ours, not a badge.

Measured uptime, per part of the service · The service level agreement · Who runs this

Questions about security