Clients sometimes ask where their website actually is. The honest answer is more useful than a cloud logo. It is a server-class machine that ALCO owns, runs and watches, and this is what is in it.

The box

One AMD EPYC processor with 16 cores and 32 threads. 256 GB of memory. 4 TB of NVMe solid-state storage, no spinning disks. 10 gigabit network links. Those numbers were read from the server itself on October 20, 2026, not copied from a brochure.

On that host runs a hosting virtual machine that gets 16 threads, 64 GB of memory and a 1 TB volume to itself. The host keeps headroom, so a busy neighbour cannot starve your site. A second, smaller virtual machine runs ALCO's own internal tooling, and nothing client-facing runs there.

The software

The hosting VM runs Ubuntu LTS with Apache and HTTP/2, PHP 8.3, MariaDB and Redis. A server-side malware scanner and a firewall run alongside. ALCO applies the updates. Databases and PHP stay in memory instead of touching disk, which is a large part of why pages are quick.

How clients are kept apart

Every client has its own hosting account: a separate system user, separate files, separate databases and separate certificates. One client's site cannot read another's files. A problem in one account stays in that account.

What runs on it

Client websites, WordPress and hand-built. The front ends of our headless CMS builds. The myALCO client area. The status checks themselves. Each in its own account. Every site and application we manage lives here, so the care it gets is the care our own site gets, because our own site is on it too.

What sits in front

Visitors do not reach the server directly. Every site and application we host sits behind Cloudflare Enterprise, so traffic hits the edge first: a web application firewall, denial-of-service protection, a cache close to the visitor and TLS at every edge. Only clean traffic reaches the box, and the box stays quiet even when a site is busy. We do not publish the server's address, location or hardware supplier.

The backups

Three copies, every day. A nightly account backup of files, mail and databases, with three daily and four weekly sets kept on the server. A daily dump of every database, kept for about two months. And an off-site copy pushed each morning to ALCO's own cloud storage, away from the machine.

A restore is tested, not assumed. Files, databases and whole accounts are restored on a schedule and the results written down, which is the same rule we hold clients to.

The watching

Every public page and service we run is checked every minute. Two failed checks in a row confirm a problem. Two good checks confirm recovery. The same checks feed the public status page at https://alcohq.com/status so what we see is what you can see.

What happens when a part fails

Here is the blunt version. It is one physical server with one NVMe disk. If the disk fails, the recovery is a restore from the off-site copy onto replacement hardware, which is a rebuild, not a reboot. That is why the off-site copy runs every morning and why restores are tested. Cloudflare can keep serving the last good copy of public pages while that happens, so visitors see a site while we work.

We would rather say that plainly than imply a data centre full of redundant everything. The design is sized for the businesses we host, backed up properly and watched every minute.

Why one server

Because we can know it completely. We know every account on it, every version, every backup set and every check. When something is slow we can see why, and when something is wrong we fix it ourselves. That is the difference between hosting on a machine you own and renting a slice of someone else's.

It also keeps the answer to where is my data simple. It is on that machine, in your account, with copies off-site each morning. No third party we cannot name, and no slice of a cloud we cannot see.

The full page, with the specifications and the questions people ask, is at https://alcohq.com/infrastructure