A seized server is a hardware loss, not a breach

The vendor questionnaire always asks: what happens if someone walks out of the datacenter with your disk.

Every Hoody host runs LUKS full-disk encryption, provisioned at install, with no way to opt out. The property that matters is where the key lives: not on the machine it unlocks. The orchestrator supplies it out of band at boot. A drive pulled from the chassis is ciphertext, and so is every snapshot on it.

What this does not cover is a running host. Once the volume is unlocked, the filesystem is plaintext to anything with host-level access, Hoody's own administration included. For data that must stay opaque on a live machine, encrypt above the disk with a crypt backend on hoody-files, where the key is yours and never reaches the host.

Two layers, two threats, one straight answer on the questionnaire.