You rent a VPS, install your software and get administrator access. Naturally, you call it “my server.” The invoice agrees. The physical computer, however, still belongs to somebody else. That small detail has rather more to say about your privacy than the word “private” in the sales pitch.
A virtual private server is a computer created in software, running on a host machine controlled by the provider. You manage what happens inside your rented environment. The provider manages the machinery that makes it exist. Those are two different levels of control.
You have root. They have the machine.
Root is the administrator account inside your server. It lets you install programs, manage users and change settings. It does not put the provider’s physical machine under your control. You are in charge of the apartment. You have not bought the building.
On a conventional VPS setup, someone with sufficient access to the host infrastructure may be able to copy the virtual disk and inspect its unencrypted contents without logging into your server. Your server password is not involved. They are approaching the data from outside the system that checks it.
This is ordinary administration territory. Libguestfs, for example, provides tools for inspecting and modifying virtual machine disk images. The tools are useful for legitimate maintenance. They also illustrate the awkward point: access to the underlying storage is a different kind of access from the login you control.
“We wouldn’t look” is doing a lot of work
A provider may have strict rules, limited staff access and good oversight. All of that matters. But “our staff are forbidden to read your files” and “our systems prevent our staff from reading your files” are different promises. A reassuring privacy policy does not make a readable disk unreadable.
The risk is not confined to a curious employee. Someone who compromises the provider’s management systems may acquire powers you never gave them. You can secure every account inside your VPS and still depend on the security of accounts outside it.
No conspiracy is required. You are trusting the operator’s people, procedures and infrastructure. Fair enough, if that is the bargain you intended to make. Slightly less satisfying if you thought “private” meant nobody else could look.
Your padlock. The warehouse manager’s spare key.
Imagine renting space in a warehouse. You fit an excellent lock, stack your boxes neatly and leave feeling responsible. The manager has another way into your unit. When you ask about it, he explains that entering without permission would be against company policy.
Lovely. You asked who could open the door. He told you who was supposed to behave.
The manager might be entirely trustworthy. That does not make the spare key disappear. You still need to know who can use it, what stops somebody else getting hold of it, and whether you would find out if it were used. “Trust us” is a request. It does not keep anyone out.
The website can work perfectly while someone reads the copy
Copying information does not require making the original disappear. Virtualization software can take snapshots of a running server’s disk; libvirt documents this as a standard capability. A copy can then be examined separately. A healthy website and a green uptime chart cannot tell you who has seen its data.
That data might be customer correspondence, invoices, source code, unpublished work or a database. It might also be a trading bot’s credentials. The problem is bigger than cryptocurrency and bigger than where you keep a password: somebody else may have a view into the environment where your work happens.
Excellent uptime. A separate conversation about privacy.
What actually stops the owner looking?
This is the useful question to ask before treating a VPS as your own private machine. Does access depend on an employee following a rule, or is there a technical barrier the operator cannot simply bypass? Who controls that barrier?
There are architectures designed to reduce trust in the host. Confidential virtual machines, for example, use hardware protections to isolate workloads from the hosting layer. Their protection depends on the configuration, including how disks and encryption keys are handled. The letters VPS alone promise none of that.
Renting computing power is useful. The mistake is assuming that administrator access gives you exclusive control over someone else’s computer. The provider still runs the machine. Whether it can look inside is something to establish, not something to take on trust.