Keeping your account secure
Someone who gets into your account does not need to break into your servers. They can reinstall them.
The portal account
- A unique password, from a password manager, used nowhere else. Credential stuffing — trying passwords leaked from other sites — is how most accounts are taken, not clever attacks.
- Enable two-factor authentication if you have not. It is the single highest-value five minutes available to you.
- A mailbox you control on the account, with its own strong password and its own second factor. Email is the reset path for everything; an old address at a former employer is an open door.
- One account per person. Shared logins cannot be revoked when someone leaves and leave no usable audit trail.
What the account can do
Worth being conscious of: from the portal, a logged-in user can power machines off, reinstall them, open a console and read invoices. A reinstall destroys the data on the target disks and we cannot undo it. That is why the account deserves the same care as root on the servers themselves.
API keys
If you use the API, treat the key as a root password:
- Out of the repository, out of the container image, in an environment variable or a secrets store
- Restricted to the addresses your automation runs from — ask us and we will tie it down
- Rotated when anyone with access leaves
- Revoked immediately if it may have leaked. Tell us and we will kill it on the spot; there is no waiting period and no charge for a new one.
What we will not do
We will not act on a request we cannot tie to your account. Specifically, we will not change the account email, add a contact, reinstall a machine or discuss what is on it with someone who merely sounds authoritative.
This occasionally slows down a genuine urgent request, and we would rather that than the alternative. Social engineering — a convincing message from a “new colleague” who needs access quickly — is a routine attack against hosting providers, not a hypothetical one.
Set up authorised contacts in advance so your colleagues can act without that friction.
If you think something is wrong
Tell us immediately, at any hour, on support@novogara.com. We would far rather investigate a false alarm than find out later. Then, in parallel:
- Change the account password and the email account's password
- Revoke API keys and re-issue
- Check the ticket history for messages you did not send
- Check your servers — see a compromised server
Phishing aimed at you
We will never ask for your password, and we will never email you a link that asks you to log in to prevent suspension. Invoices come from our own domain and are also visible in the portal — if a payment message looks urgent, ignore the link and check the portal directly. If you are unsure whether a message is from us, forward it to support and ask.
Still stuck? Mail support@novogara.com — an engineer answers, at any hour. Back to the knowledge base