Live demo Subscribe →
Security

Security you can evaluate.

Server infrastructure shouldn’t depend on vague promises.

auraPanel documents how authentication, authorisation, workload isolation, secrets, updates and privileged actions are handled — as well as the responsibilities that remain with the server administrator.

IdentityPasskeys, two-factor authentication, session controls and additional verification for sensitive operations.
AccessRole-based permissions control which users can view or change individual resources.
IsolationApplications run under separate Linux users with confined file-system access.
SecretsSensitive stored credentials are encrypted at rest.
UpdatesauraPanel updates are signed and checksum-verified before installation.
AccountabilityPrivileged actions are recorded in the audit log with the user, resource and time.
PrivacyauraPanel does not collect usage telemetry.

Your server remains your infrastructure.

Overview

auraPanel runs on infrastructure you control. It provisions and manages sites, databases, certificates and users on a Debian or Ubuntu host, and it is the only party on that host with panel-level authority.

This page states which controls auraPanel provides and which responsibilities remain with whoever operates the server. Both halves matter: a control panel cannot secure a host on its own, and claiming otherwise would be the opposite of useful.

Authentication

Passkey sign-in (WebAuthn) is the primary credential; password with TOTP two-factor is the alternative. Sessions are held server-side, sign-in is rate-limited on the client address nginx reports, and sensitive actions require step-up verification.

An administrator can revoke the passkeys registered to a lost device.

  • Passkeys / WebAuthn
  • TOTP two-factor
  • Step-up verification
  • Server-side sessions
  • Login rate-limiting

Authorisation

Access is role-based with per-resource permissions. A role maps to exact create, read, update and delete rights on each panel resource, and grants can be scoped to individual sites.

  • Per-resource CRUD
  • Custom roles
  • Per-site grants

Execution model

System commands run without a shell. Arguments are passed directly to the process rather than interpolated into a command line, which removes the class of vulnerability where a value in a form becomes part of a command. Panel operations validate their input before acting.

  • No shell interpolation
  • Validated input

Filesystem isolation

Each site is its own Linux user. SFTP is chroot-jailed to that site. The browser file manager drops privileges to the site user and is kernel-confined to the site directory, so a crafted path cannot escape it.

The practical consequence: one site does not automatically get to read another site’s files or its database credentials.

  • One Linux user per site
  • chroot SFTP
  • Kernel-confined file operations

Secrets and data storage

Stored secrets and two-factor seeds are encrypted at rest with NaCl secretbox; the key lives at /etc/aurapanel/secret.key with 0600 permissions. Panel state is written crash-safely and durably.

  • Encrypted at rest
  • Durable writes

Network edge

HTTPS is issued and renewed automatically for hosted sites, including wildcard certificates over DNS-01 where configured.

Origin lock is available per site: allowlist your CDN’s published address ranges, refreshed automatically, and require authenticated origin pulls (mTLS), so the origin answers only traffic that arrived through the edge.

  • Automatic HTTPS with daily renewal
  • DNS-01 wildcards
  • Origin allowlist
  • Authenticated origin pulls (mTLS)

Updates and supply chain

Updates are fetched on demand. There is no scheduled background polling. Each build is Ed25519-signed and checksum-verified before it installs, and an unverified build fails closed rather than installing.

  • On demand only
  • Ed25519-signed
  • Checksum-verified
  • Fails closed

Audit log

Privileged actions are recorded with actor, resource and timestamp — who did what, to which resource, and when. The log is readable in the panel by anyone holding the permission to see it.

  • Actor / resource / time

Network behaviour

auraPanel does not continuously transmit product usage information. Outbound connections happen when you act — fetching an update, issuing a certificate, reaching an integration you enabled — and to validate an active subscription. The contents of the sites you host are never part of that.

  • No usage telemetry
  • Outbound on action
  • Subscription validation

Shared responsibility

auraPanel secures what it manages. The following remain with the server operator, and no control panel can take them over:

  • Host hardening beyond the panel’s scope: SSH configuration, kernel updates, firewall policy (the installer can set up UFW and fail2ban, but policy is yours)
  • Credential hygiene for the accounts you create, and timely review of panel updates
  • Application-level security of the sites and code you deploy
  • Verifying that backups restore — the panel schedules and ships them; confirming they work is an operational habit

Questionnaires and review

Every auraPanel licence includes the whole model on this page — nothing here is held back for a higher plan. Enterprise adds the commercial side of a security review: priority response with agreed times, support for your questionnaire and procurement process, and contract terms.

Request a written response →

Try the live demo

A real auraPanel on a real server, shared with everyone. Sign in with the demo account and click around.

Email
demo@goaura.one
Password
demo1234
Open the demo panel ↗

Shared public demo, so please don’t put anything personal in it. More about the demo →

Talk to us

Tell us what you need and how to reach you. A person reads this, not a queue.

We use these details only to reply to you. Privacy

Recent updates

What shipped in the last releases. With automatic updates on, each lands on your server the moment it is published.

  1. v1.21.3
    Framework sites were undetectable, and a restore could silently point the copy at the original's live database.

    DetectApp looked for each application's signature relative to the docroot — but every PHP framework in the registry serves from a subdirectory (DocrootSub: public, webroot, web, pub, docroot) and keeps the file that identifies it one level *above* that. So the Laravel signature searched <project>/public/artisan,…

  2. v1.21.2
    Restarting nginx now blocks the panel and reconnects, instead of showing a notice.

    v1.21.1 stopped the false "HTTP 520" but only put up a toast — and a toast is the wrong affordance when the panel itself is about to go away: the page sat there looking broken while every request failed underneath it.

  3. v1.21.1
    Restarting nginx from Services no longer reports a false failure.

    It showed "Restart failed — HTTP 520". The panel is reverse-proxied *by* nginx, so the request deadlocked against itself: the handler blocked waiting for the restart to finish, while nginx's graceful stop waited for that very request to drain. Neither could proceed until nginx's stop-retry timeout force-killed it,…

  4. v1.21.0
    Per-site X-Frame-Options, fixing page builders that couldn't load their preview.

    Elementor's editor failed with *"Multiple 'X-Frame-Options' headers with conflicting values ('DENY, SAMEORIGIN')"*. The cause is that nginx's add_header appends rather than replaces: when the application also sets the header — a WordPress security plugin, or a CDN transform — the browser received two values,…

  5. v1.20.6
    The multi-database restore refusal now says what is in the backup and what still works.

    It read only "Restoring a multi-database site isn't supported yet", which is a dead end: it named neither the databases involved, nor why one of them is the limit, nor any route forward.

  6. v1.20.5
    Services: cards in a row now match heights.

    Like the settings grid before it, the Services grid pinned each card to its own content height, so a row often showed one card noticeably shorter than the card beside it. Each row now takes the taller card's height and both fill it, and it re-balances as content changes — a runtime installed, a longer service list.

  7. v1.20.4
    Settings: paired cards now match heights.

    Organisation / Panel Domain and auraPanel Updates / Session timeout each sat at their own content height, so a row showed one card visibly shorter than its neighbour. Each row now takes the taller card's height and both fill it — driven by content, not a fixed value, so it still adapts as a card grows (a validation…

  8. v1.20.3
    Settings: Organisation and Panel Domain now share a row too.

    They were full-width blocks stacked above the rest of the page; they now sit side by side in the same two-column grid as the Updates / Session timeout pair, so the top of Settings reads as two tidy rows instead of four stacked bands. Both cards shrink cleanly — the logo drop zone is a fixed 44×44 and the name field…

All releases on GitHub ↗