# How it's kept safe

People are sometimes surprised that a home setup can be run responsibly, so
here's the philosophy in non-technical terms:

- **The front door is tiny.** The vast majority of the lab is reachable only
  from inside my own network. The few things friends can reach from outside go
  through a single, locked-down gateway that does nothing else — not through my
  home router, which forwards nothing.
- **Encrypted everywhere it matters.** Connections from outside are encrypted,
  and remote access between my own machines rides a private, encrypted mesh
  network rather than the open internet.
- **Least exposure.** Optional features that aren't in use simply aren't turned
  on. Fewer moving parts, fewer things to secure.
- **Backups and recovery.** The important stuff is backed up on a schedule, and
  there are written recovery steps for when something breaks (because it
  eventually does).

This page is deliberately vague on specifics — that vagueness is part of the
security. The point is just that "self-hosted" and "careful" aren't opposites.