Who You're Contracting With
BetterSiteHost is operated by Aspect Services, LLC, a limited liability company incorporated in the State of California, United States, in 2008. Aspect Services owns and operates BetterSiteHost, Total CMS, and Weaver's Space. All service agreements are with Aspect Services, LLC.
The brand is recent; the hosting operation behind it is not. BetterSiteHost is the productization of infrastructure we have run since 2015.
What We Supply, and What You Configure
We are responsible for provisioning, managing, patching, and monitoring the servers, and for the availability of the hosting infrastructure.
We are not responsible for how a site is implemented or configured. Content, content governance, access permissions, form handling, site-level backup schedules and destinations, scheduled jobs, and any third-party services connected to a deployment are configuration decisions made by the implementer. Where an end client carries specific regulatory obligations, those are satisfied through implementation choices and the implementer's own agreements with their client.
This is a standard shared-responsibility model, and it is worth stating plainly: we supply secure infrastructure, you configure it appropriately for the deployment.
Infrastructure
Compute. Managed virtual private servers on Vultr infrastructure.
Management. Server provisioning, configuration management, patching, and monitoring through ServerAvatar. We hold their Premium Hosting Care Plan, providing a dedicated support channel staffed 24 hours a day, seven days a week; proactive monitoring of server uptime and performance, with their engineering team investigating and remediating emerging issues rather than waiting on a ticket; and direct engineering access for infrastructure-level troubleshooting.
Server-level incident detection and response therefore operate continuously and independently of any single individual at Aspect Services.
Infrastructure uptime SLA. Vultr provides a 100% uptime guarantee covering network availability and host node availability, backed by service credits proportional to the affected instance. The guarantee covers network performance and host hardware. It does not extend to software-level outages, configuration errors, or scheduled maintenance announced with 24 hours' notice. Reference: vultr.com/legal/sla
Infrastructure certifications. Vultr's infrastructure security controls meet SOC 2 (including HIPAA), ISO 27001 / 27017 / 27018, and PCI DSS standards. Current status: vultr.com/trust-center
Our own certification status. Aspect Services, LLC does not hold an independent SOC 2 attestation. Compliance certification is held at the infrastructure layer by the data center operator, which is where the physical facilities, network, and hypervisor controls reside.
Server-level security. Every server runs a host firewall with a default-deny policy, permitting only required services — SSH, HTTP, and HTTPS — plus the management agent. Intrusion prevention (fail2ban) is active by default, automatically blocking sources that exhibit brute-force behavior against server services.
Application-layer protections — an 8G firewall ruleset and bot blocking — are available per site and enabled according to each deployment's requirements. For enterprise deployments these are configured as part of provisioning.
Data Residency
Data residency is guaranteed at the deployment level. Workloads remain in the data center region selected at provisioning and do not migrate between regions.
Regions are available across North America, Europe, Asia-Pacific, South America, Africa, and Australia. Deployments with EU data-residency requirements are provisioned in an EU region by default. The specific facility is selected at provisioning based on client requirements.
Sub-processors
Sub-processors engaged by Aspect Services, LLC in delivering hosting:
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Vultr Holdings LLC | Compute and instance storage | Customer site data at rest | Customer-selected region |
| ServerAvatar Cloud Technologies Private Limited | Server provisioning, management, monitoring, support | Server configuration and administrative metadata; administrative server access | India |
| Stripe, Inc. | Billing and payments | Billing contact and payment data | US / EU |
Management panel. The server management panel is a white-label deployment running on infrastructure we operate. Server configuration is held on our systems rather than in ServerAvatar's platform. Server logs are fetched on demand when viewed through the panel and are not stored off the server — there is no routine transmission of logs or metrics to ServerAvatar's systems.
ServerAvatar access. ServerAvatar has confirmed that their engineering team retains technical capability to access managed servers, the applications running on them, and the data stored there. This access exists to provide support, maintenance, and troubleshooting.
They have confirmed in writing that this access is used only when investigating or resolving a support request or technical issue, that they do not routinely monitor, review, or inspect customer data, and that they do not create or maintain any backups of customer data. This is governed by policy and agreement rather than enforced by technical restriction — we state that plainly rather than imply a control we do not have.
Administrative activity is logged. The management platform maintains an audit log of administrative actions performed against managed servers, spanning server configuration, applications, databases, SSL, DNS, firewall rules, file manager operations, backups, and user management, across create, update, delete, install, service, restart, and download events. The log is filterable by activity type, action, and timeframe, and retains complete history since account creation.
This is an administrative action log covering operations performed through the management platform. It does not record read or view operations.
International transfers. ServerAvatar is established in India. For deployments subject to GDPR, support access by their team constitutes a transfer to a third country. That access is incident-scoped rather than routine: no customer data flows to their systems in the ordinary operation of the service. Customer content remains resident in the selected data center region at all times.
Services you engage are not our sub-processors. Where a deployment is configured to send backups to external storage, route traffic through a CDN, deliver mail through a third-party provider, or synchronize data to any external service, those providers are engaged by the implementer or end client and belong in their own processing records. We have no visibility into or control over those configurations.
Data Protection
Encryption in transit. TLS 1.2 and 1.3 are supported on BetterSiteHost servers; TLS 1.0 and 1.1 are disabled. Certificates are provisioned and renewed automatically. Our standard server configuration achieves an A+ rating under Qualys SSL Labs testing.
Where a client places a CDN or reverse proxy in front of their site, transport security at the edge is governed by that service's configuration rather than ours.
Hosting account credentials are stored hashed, never in plaintext.
Our access to your data. Access to hosted content is limited to administrative and support purposes.
Retention and deletion. While an account is active, content is retained for the life of the deployment.
Deletion on request. Where an account holder deletes a server, destruction is immediate and irreversible. There is no holding period and no administrative step on our side that delays or reverses it. Backup images held at the infrastructure layer persist for up to 7 days after instance deletion and are then purged automatically and permanently.
Delinquency. Where an account lapses for non-payment, the deployment is retained for a 30-day grace period during which it can be restored or a full export provided on request. After that period the server is destroyed, with the same 7-day backup persistence described above.
Application backups written to the account holder's own storage — S3, Wasabi, Google Drive, Dropbox, or S3-compatible destinations — remain in that storage under the account holder's control, at whatever retention they configured, for as long as they choose to keep them. We have no access to those copies and cannot delete them. Where a deployment is subject to a deletion obligation, purging them is the account holder's responsibility.
Billing records are retained separately for approximately seven years, as required by US tax and accounting obligations. This applies regardless of account status and covers transaction records rather than hosted content.
Erasure requests under applicable data protection law can be made to [email protected] and are actioned within the limits described above.
Export on exit. You have full access to your server and its file system throughout the life of the account. Sites, databases, and files can be copied out at any time by any standard method. We hold nothing in a proprietary format and charge no export or offboarding fee.
Backup & Recovery
Backups are not enabled by default. Neither backup layer is active on a new deployment. Establishing a backup regime appropriate to the deployment is the account holder's responsibility, and we recommend doing so before a site goes into production.
Two layers are available, capturing different things with different retention.
Application backups. Scheduled backups of application files, databases, or both, with retention configurable from one week to 24 months. These are configured by the account holder through the management panel and written to storage under their own control — S3 or S3-compatible storage, Wasabi, Google Drive, or Dropbox. Backup copies reside in the account holder's storage rather than ours, remain accessible independently of BetterSiteHost, and are not subject to our retention or deletion policies.
Full instance backups. Image-level backups of the entire server, including operating system, server configuration, applications, and data. Available on request as a paid addition to the hosting plan, since they carry an additional infrastructure charge. Schedule is configurable — daily, every other day, weekly, or monthly — and the two most recent images are retained, with older ones rotated out. These are a whole-server restore mechanism and do not support recovery of individual files.
What each layer covers:
| Application backup | Full instance backup | |
|---|---|---|
| Operating system and server configuration | No | Yes |
| Application files | Optional | Yes |
| Databases | Optional | Yes |
| Retention | 1 week to 24 months | Two most recent images |
| Restore granularity | Files and databases | Whole server only |
| Storage location | Account holder's own storage | Infrastructure provider |
| Enabled by | Account holder, via the panel | Request, additional charge |
The two address different failures. Total server loss is recovered fastest from an instance image. A problem discovered later — content corruption, accidental deletion, an error introduced weeks earlier — needs the retention depth of the application layer. For production and enterprise deployments we recommend both.
Server configuration is captured only in the instance image. Where instance backups are not in use, server configuration is reproducible from our management platform rather than dependent on backup recovery.
Restore testing. Restore procedures have been tested and validated.
RPO. Determined by what the account holder has configured. With daily backups, the recovery point objective is up to 24 hours. Deployments requiring a tighter RPO can run the application layer at higher frequency, or discuss a bespoke arrangement.
RTO. Recovery time depends on the nature of the failure and on the backup configuration in place.
Infrastructure-level failures — host hardware, network — are handled by the infrastructure provider and typically resolve without intervention on our part.
Where full instance backups are configured, restoration of a complete server is typically achieved within 4 hours of recovery being initiated. Where only application backups are in place, the server is reprovisioned and restored, typically within 8 hours. Where no backups are configured, no recovery objective applies.
Recovery time is measured from the point at which recovery begins. For issues raised through the support desk, that is within business hours unless an enhanced support arrangement is in place. Deployments requiring a committed recovery time should contract one.
Availability
Hosting availability rests on the infrastructure provider's 100% uptime guarantee for network and host node availability, backed by service credits. Servers are monitored continuously, with incidents detected and addressed 24/7 as described under Support below.
We do not publish a separate application-level availability percentage for standard hosting. Deployments requiring a contractual availability commitment should raise it during contracting, where it is agreed alongside the architecture needed to support it.
High-availability architecture is available for deployments requiring failover beyond a single instance:
- Primary server in the client's chosen region
- Warm standby in a second data center facility
- File synchronization between primary and standby
- DNS-level health-check failover with automatic traffic redirection on primary failure
Deployments without a database — including flat-file applications — failover particularly cleanly under this model, since there is no replication lag to manage.
Edge layer. We strongly recommend placing a CDN and web application firewall in front of any production deployment, particularly for public-facing sites with traffic spikes or elevated security requirements. That layer sits outside our supply and is contracted directly by the implementer or end client, who retains full control over configuration and any associated data processing.
Support
Standard support is included with all hosting accounts, covering account, server, and hosting-environment issues.
Infrastructure incident response operates 24/7. Server availability and performance are monitored continuously by ServerAvatar's engineering team under our Premium Hosting Care Plan. Server-level incidents — host failure, resource exhaustion, service crashes — are detected and addressed around the clock, independently of our support desk hours.
Our support desk operates during business hours, 9am–5pm Pacific Time, Monday through Friday, for account queries, configuration assistance, and non-urgent hosting issues.
Enhanced support arrangements — extended coverage, defined response commitments, named escalation paths — are available and negotiated per deployment. Enterprise clients with specific service level requirements should raise them during contracting.
Issues in the application software running on a deployment are handled under that software's own support terms, separately from hosting. Where we also supply the application, its support and security commitments are documented separately from this page.
Business Continuity
Aspect Services, LLC is a small, focused business. The mitigations are worth stating directly:
- Server operations are not single-threaded. ServerAvatar's Premium Hosting Care Plan provides 24/7 staffed support and proactive monitoring by their engineering team. Server-level incidents are detected and addressed continuously.
- No proprietary lock-in. Deployments run on standard server software on standard infrastructure. Nothing about a hosted site depends on us remaining reachable for it to keep serving.
- Infrastructure is tier-one and portable. Servers can be transferred or migrated to any provider at any time.
- 18 years of continuous operation as Aspect Services, LLC, with hosting operations running since 2015 and 300+ sites currently hosted.
Contact
Aspect Services, LLC — California, United States