vBoxx
    Back to help center
    Security, firewalls and encryption

    Encrypting data on your hosted Mac

    Pick the right encryption strategy for a server that almost never powers off.

    7 min read

    TL;DR

    Full disk encryption (FileVault) only protects data when the Mac is off. Your vBoxx Mac is on 24/7, so FileVault does close to nothing in practice. What you usually want is encryption you can lock and unlock on demand while the server keeps running.

    Step 1: define your threat model

    Before picking a tool, decide what you are protecting against.

    • Network attackers. SSH brute-force, exploited services, leaked tokens. Disk encryption does not help here, because the disk is unlocked while macOS is up. Patch fast, restrict ports, use SSH keys.
    • Physical theft from the data centre. This is what disk encryption is for. Our facilities in Amsterdam, Naaldwijk and (optionally) Frankfurt all run on locked, audited cages, but encryption is your last line of defence.
    • vBoxx itself. We don't store your macOS passwords or SSH keys, and our staff cannot log in to your Mac. If you want a mathematical guarantee, hold the key yourself.
    • Compliance. Sometimes "FDE: enabled" is a checkbox on a contract. That alone is a valid reason.

    Step 2: pick the tool

    NeedRecommended approach
    Compliance checkbox or device theft onlyFileVault on Apple silicon + Tahoe (see FileVault guide)
    Protect specific project / customer dataEncrypted sparse bundle disk image
    Protect databases or app data while runningApplication-level encryption (Postgres pgcrypto, app-side AES, etc.)
    BackupsEncrypt at the backup target, not on the server

    Encrypted sparse bundle, step by step

    # Create a 200 GB encrypted, sparse, growing image
hdiutil create -size 200g -encryption AES-256 -type SPARSEBUNDLE   -fs APFS -volname "Secrets" ~/Vaults/secrets.sparsebundle

# Mount on demand (prompts for the password)
hdiutil attach ~/Vaults/secrets.sparsebundle

# Detach when you're done
hdiutil detach /Volumes/Secrets

    The Mac still boots without intervention, and the sensitive data is sealed until you mount the volume.

    What we already do for you

    • Locked racks, badge + biometric access, 24/7 surveillance.
    • TLS-only access to the customer portal and all our APIs.
    • We never store your macOS credentials.