Encryption

The site

The public site is served over HTTPS. The panel token travels in an Authorization header and is not placed in a URL.

We store only the SHA-256 hash of that token. A database copy of the hash does not let someone open the panel.

The payment

Card data is entered on Stripe Checkout, on checkout.stripe.com. This origin does not load a card field and does not receive the card number.

A renewal and an upgrade use a new Checkout session. We do not save a card for next time.

The virtual server

Traffic to your server is encrypted only if you configure that on the server. We do not hold a copy of your disk encryption key. If you lose it, we cannot recover the disk.