Where does your data actually live?
And who can actually read it?

Your data sits on someone else's computer, readable by that company's systems. Google reads your emails to target ads. Microsoft scans your OneDrive files for content policy violations. iCloud photos are scanned client-side before upload.

These companies comply with government data requests routinely. In 2024, Google received over 200,000 government requests for user data globally and complied with roughly 75% of them.

This is where most small businesses operate today. The provider is both the landlord and the locksmith — and they have a copy of every key.

A step up. You rent a virtual machine and install your own software. The cloud provider doesn't routinely read your data — they have no business reason to. But they can, because they control the physical hardware your VM runs on.

The provider can: snapshot your VM's disk, image it, hand it to law enforcement, or access it for "maintenance." Most providers offer "encryption at rest," but they hold the keys — it protects against stolen physical drives, not against the provider themselves.

If the provider is US-headquartered (Azure, AWS, Google Cloud), the US CLOUD Act allows US authorities to compel access to your data regardless of which country the server is physically in. A European company's data on an Azure server in Frankfurt is still subject to US legal jurisdiction.

This is where most managed hosting and "cloud ERP" providers operate. Better than Level 0, but the provider still has the keys to your house.

This is where things fundamentally change. Your data volumes are encrypted with LUKS2 — a standard Linux encryption system — using keys that Meanwhile and you hold. Not the cloud provider.

The database has its own encryption layer (MariaDB TDE). Your uploaded files are encrypted at the application layer with your own key. Three independent layers of encryption, none of which the cloud provider can unlock.

The RAM gap matters: a sophisticated attacker with hypervisor access could theoretically read data that's currently in memory. This is why Level 3 exists. For most businesses, Level 2 provides protection far beyond what any standard hosting offers — the attack requires nation-state capability and physical access to the specific server your VM runs on.

This is where Meanwhile operates by default. Every instance gets LUKS2, MariaDB TDE, per-file encryption, and WireGuard. It's not a premium tier — it's standard.

This closes the RAM gap. Confidential computing uses hardware-level encryption (AMD SEV, Intel TDX) to encrypt your VM's memory so that even the hypervisor — and therefore the cloud provider — cannot read it. Bare-metal servers eliminate the hypervisor entirely.

At this level, the cloud provider has physical custody of the hardware but cannot access anything useful. Your disk is encrypted (LUKS2), your database has its own encryption (MariaDB TDE), your files have per-customer encryption, your RAM is encrypted in hardware, and your network traffic travels through encrypted tunnels.

Available from Meanwhile as a high-security tier for customers with elevated compliance requirements. Higher cost, limited region availability. The architecture is identical — only the VM type changes.

The ultimate level: your data runs on hardware you physically control. No cloud provider in the picture. No hypervisor. No shared infrastructure. Your data never leaves your premises unless you choose to send it somewhere.

Meanwhile's portable instance is a complete, runnable copy of your system that you download and run on your own hardware. It connects back to Meanwhile's network through an encrypted tunnel for public access — but the data lives on your machine, encrypted with your key.

Any Meanwhile customer can do this at any time. Download your backup, enter your key, run it. No permission needed, no exit fee, no lock-in. Your data is yours.