Every Service is in its own VM and everything thats publicly accessible sits in its own network sepperated from everything else. I do daily backups in case anything goes wrong