Your DR traffic commutes on the public internet.
Everyone asks where their data lives. Almost nobody asks what it rides between sites. Ours: an always-on IPsec mesh, never the open internet.
In this article 2 sections
- Compliance reviews ask where data is stored. Almost none ask what it travels on between sites: replication, DR sync, failover traffic.
- Some providers send replication across the public internet: best-effort routing, congestion someone else controls, and whatever encryption the application layer brings.
- Here, traffic between our datacenters rides an always-on IPsec-encrypted mesh. Inter-site storage replication and customer DR traffic use it by default.
- The follow-up questions for any host are simple: is the path private, is it encrypted at the network layer, and is that the default or a paid add-on?
The audit is thorough about some things. Datacenter certifications, checked. Encryption at rest, confirmed. Jurisdiction and residency, mapped to the row in the spreadsheet. The reviewer signs off feeling the data is accounted for.
Then the same data crosses between two sites on a schedule, every hour of every day, and no line in the audit asked what it crosses on. Where the bytes sleep got a dozen questions. The commute they make between datacenters got none.
What cross-site traffic rides on, elsewhere
The mechanics are not sinister, just unexamined. A provider without its own infrastructure between two sites sends replication the only way it can: across the public internet. That means best-effort delivery when the path is congested, routes that change without notice or explanation, and privacy at the network layer only if someone stood up a tunnel and still maintains it. None of that is a scandal. It is a default nobody actually chose, filed under "plumbing" and never opened again.
What it rides on here
Here the answer is built into the network. Our datacenters are connected by an always-on, IPsec-encrypted mesh. Inter-site storage replication and customer DR traffic ride it, not the open internet. It exists because we own the network at both ends and in between, which is what turns network-layer privacy into a default instead of a per-project engineering effort someone has to remember.
One piece of honesty, before a skeptic supplies it. A private encrypted path does not repeal physics. Cross-site replication over real distance is asynchronous, with a recovery point designed per workload.
“Privacy that depends on every application remembering to encrypt is a policy. A private path is a property.”
So here is the buyer's script, short enough to forward. Ask any host three things. What physical or logical path does replication take between my sites? Is it encrypted at the network layer, or only where individual applications bring their own? And is that the default, or an add-on with a price? Clear answers exist. A vague answer is an answer too.
Straight answers
Is replication traffic between datacenters usually encrypted?+
Only if someone made it so. Application-layer encryption varies by service, so it covers only the traffic from services configured to use it. Network-layer encryption, an IPsec tunnel or mesh, covers everything on the path regardless of which application forgot. Ask which one your provider relies on.
Does EuroVPS replicate over the public internet?+
No. Traffic between our datacenters rides an always-on IPsec-encrypted mesh, and inter-site storage replication and customer DR traffic use it by default.
Is a private path faster than the public internet?+
It is more predictable, which is the honest claim. The path does not change when someone else's traffic congests a route. We publish no latency figures here; what we commit to is the property, private, encrypted, always on, and we design DR to the workload.
Can cross-site replication be synchronous with no data loss?+
Across meaningful distance, no. Physics sets a floor, and honest cross-site replication is asynchronous, with a recovery point designed per workload.
What should I ask a provider about DR traffic?+
Three things: the path (private or public), the encryption layer (network-wide or application-by-application), and the default (included or a paid add-on). The answers describe a provider's network ownership more honestly than any architecture diagram they will show you.
Designing DR? Ask about the commute.
We'll show you what the network actually does: a private, always-encrypted path between sites, and an RPO designed to your workload.
Talk to an engineerYou’ve reached the end.
Put the reading to work
What are
you running?
Tell us about the workload, traffic and recovery requirements. Start with the server builder, or talk through the details with an engineer.
Written by the engineers who build and run the infrastructure it describes.Talk to an engineer