Your Part When You Self-Host
Running your own social platform gives you real control — and, in return, a small amount of real responsibility. The good news is that none of it is complicated, most of it is one-time setup, and our deployment guide walks through every step. Here's how to keep your instance as secure as it's designed to be:
- Keep it updated — install operating-system and RSocial updates when they arrive. Most security problems in the world are old, already-fixed ones that were never patched; staying current closes them before anyone can use them.
- Turn on TLS — set up a certificate (Let's Encrypt provides them free, and the guide shows how) so that all traffic to and from your instance is encrypted rather than sent in the clear.
- Limit what's exposed — only make your instance reachable from the internet if you actually need remote access, and use a firewall to close every door you're not using. The less that's exposed, the smaller the target.
- Use a strong passphrase and enable 2FA — the front door is only as strong as the password behind it. Choose a long, unique passphrase and switch on two-factor authentication so a leaked password alone can't get anyone in.
- Look after the hardware — keep the physical device somewhere safe, consider full-disk encryption, and hold an encrypted backup off the device so a loss or theft is an inconvenience, not a disaster.
You don't need to be a security expert to do any of this. The secure choices are built in by default; these steps simply make sure the parts that depend on your environment are set up properly too.
Security FAQ
What happens if my Raspberry Pi is lost or stolen?
Whoever ends up with the device still has to get past your login, and with 2FA switched on a password alone isn't enough. Any encrypted backups stay completely unreadable without your passphrase, so you can restore your data onto new hardware while the stolen device gives up nothing useful. For the strongest protection, turn on full-disk encryption on the device itself — then even the raw storage is scrambled if someone removes it.
Can the RSocial project, or anyone at "RSocial," see my data?
No. There are no central RSocial servers and no cloud account tied to your instance. Your data lives on your device and never leaves it unless you send it somewhere yourself. There is simply nothing on our side to look at, because there is no "our side" in the path your data takes.
If there are no ads, how do I know I'm not the product?
Because the software contains none of the machinery used to make you the product — no ad libraries, no trackers, no third-party scripts, no data being sent out. A platform that isn't funded by advertising has no reason to collect and sell your behaviour. See No Ads, No Tracking for the detail.
How are security issues and vulnerabilities handled?
Because you run your own instance, keeping it updated is the single most effective thing you can do — updates deliver security fixes straight to your device. Security is treated seriously throughout development, and safe deployment practices are documented so your setup starts from a strong baseline.
Do I need to be a security expert to run RSocial safely?
No. The secure choices — encrypted backups, hashed passwords, signed sessions, server-enforced permissions — are built in and on by default. The few steps that depend on your environment, like turning on TLS, enabling 2FA, and installing updates, are explained in plain language in the deployment guide.
Is my data encrypted all the time, even on the device?
Backups are always encrypted, and connections are encrypted in transit once TLS is on. For the data at rest on the device itself, enabling full-disk encryption is the recommended step — it's a standard operating-system feature and means the storage is unreadable to anyone who doesn't have the device unlocked.