How a VPS Works
A Virtual Private Server (VPS) is a software-defined virtual machine running on top of a physical host server. The host server — which is large, powerful, and owned by your hosting provider — runs a piece of software called a hypervisor. The hypervisor divides the physical machine's resources (CPU, RAM, storage) into isolated slices and presents each slice as an independent server to its customer.
From inside your VPS, the experience feels like a dedicated server. You have root access, you control the operating system, and you can run whatever software you need. But underneath your operating system, the hypervisor is always present, managing the physical hardware and allocating resources between you and the other VPS customers sharing your physical host.
Popular hypervisors include KVM, VMware ESXi, and Xen. They are mature, widely deployed, and generally well-secured. For most use cases — development environments, web applications, low-sensitivity databases — VPS is an excellent and cost-effective choice. But "generally well-secured" is not the same as "provides strong privacy guarantees."
The Hypervisor Attack Surface
The hypervisor's position in the stack — between your virtual machine and the physical hardware — creates attack surface that does not exist with dedicated servers.
VM escape vulnerabilities are bugs in the hypervisor that allow code running inside a virtual machine to break out and access the host system or other VMs. These are rare but real: CVE-2018-3646 (L1 Terminal Fault) and the Spectre/Meltdown family of vulnerabilities allowed cross-VM data leakage on shared physical hosts. Hardware manufacturers and hypervisor vendors patch these aggressively, but new variants continue to be discovered.
Host provider access is more mundane but more certain. Your VPS host provider has administrative access to the hypervisor layer. This means they can, at any time, take a snapshot of your running virtual machine — capturing the contents of memory, including any encryption keys that happen to be loaded at the time. This is a legitimate operational capability used for backup and migration. It is also a capability that can be exercised under a court order, or — in the worst case — by a malicious insider.
Noisy neighbour effects are primarily a performance concern, but some timing-based side-channel attacks exploit them for data leakage. Shared CPU caches have been used in academic research to extract cryptographic keys from co-located virtual machines.
How a Dedicated Server Works
A dedicated server — bare metal — is a physical machine assigned to a single customer. There is no hypervisor. Your operating system runs directly on the hardware. No other customer shares your CPU, your RAM, your storage, or your network interface.
The absence of a hypervisor eliminates the entire class of hypervisor-level attacks. There is no VM escape to worry about because there is no VM. There is no cross-VM memory leakage because there are no VMs. There is no host provider snapshot capability because there is no snapshot infrastructure — the hardware vendor can only access the machine by physically touching it.
The only software layer between your operating system and the hardware is the hardware's own firmware (UEFI/BIOS), and while firmware attacks are theoretically possible, they are nation-state-level capabilities far outside the threat model of most email services.
Comparison: VPS vs. Dedicated Server
| Feature | VPS | Dedicated Server |
|---|---|---|
| Shared physical hardware | Yes | No |
| Hypervisor layer | Yes | No |
| Memory isolation | Software-enforced | Physical |
| Provider snapshot risk | Yes (hypervisor) | No |
| Cost | Lower | Higher |
| Performance consistency | Variable (shared host) | Consistent |
When VPS Is Fine — and When You Need Dedicated
VPS hosting is entirely appropriate for a wide range of applications. Static websites, development environments, low-traffic web apps, personal projects, test systems — none of these require the privacy guarantees of dedicated hardware. The hypervisor attack surface is theoretical in most practical contexts, and the cost savings of VPS are real and significant.
The calculus changes when the data being processed is sensitive and the consequences of exposure are serious. Email is exactly this category. Your inbox contains private communications, financial records, authentication flows, medical information, and professional correspondence. The potential for harm from a hypervisor-level exposure of an email server's memory — capturing decryption keys mid-operation — is not hypothetical. It is a plausible attack scenario that dedicated hardware eliminates entirely.
Other cases where dedicated infrastructure is worth the cost: financial services data, healthcare records, legal communications, any context where the confidentiality obligation is professional or regulatory rather than merely personal preference.
What enemail Uses
enemail runs exclusively on Evolushost dedicated servers in Frankfurt, Berlin, and Vienna. We evaluated VPS options during our infrastructure planning and rejected them precisely because of the hypervisor risk. For a service that handles private encrypted email, the ability of a host provider to snapshot running memory is an unacceptable risk — regardless of how unlikely it is in practice.
Combined with our zero-knowledge encryption architecture, the dedicated server foundation means that even if a hypervisor-level attack were somehow possible, the data captured would be ciphertext. The decryption keys live on your device, not on our servers. But we prefer not to rely on encryption alone when we can eliminate the attack vector at the infrastructure level. Defence in depth means removing risks wherever possible — not just mitigating them cryptographically.