What CloudPilot holds, and what it does not

A control panel with access to your servers is worth being suspicious of. This page says plainly what is stored, what is not, and where the guardrails are.

Credentials it does not keep#

Your SSH password or key. When CloudPilot installs the agent over SSH, those credentials are used for that one connection and never written down. There is no field for them on the server record or on the install job. Rotate the password afterwards and CloudPilot will not notice, because it has no copy.

Your database password. When an engine refuses socket authentication and CloudPilot asks you to sign in, that username and password live in the browser tab you typed them into and are attached to each request. Close the tab and it is gone. That is why it asks again tomorrow.

Your application logs. Log search is answered by the agent reading the files already on your machine and returning only the matching lines. Logs routinely carry personal data, and none of it accumulates on the panel.

Credentials it does keep, and how#

Your account password is stored as a bcrypt hash, never in a form that can be read back.

Backup storage keys and webhook URLs are stored encrypted. If the server is not configured with a key to encrypt them, CloudPilot refuses to save the record rather than storing it in the clear.

How the agent is exposed#

The agent dials out to CloudPilot and holds the connection open. It does not listen on a public port, so there is no CloudPilot port on your server for anyone to find, and a machine behind NAT works normally.

Guardrails on the dangerous parts#

The firewall cannot lock the panel out. A rule that would cut SSH or the agent's own connection is refused outright — not warned about, refused. Every other rule is applied with a 60-second deadline and reverts unless confirmed, because losing contact is exactly what happens when a rule locks you out. See Firewall.

Deleting a project does not take your site down by default. Tearing the application off the server is a separate, explicitly-ticked choice. See Deleting a project.

Protected projects need two people. Deploys, rollbacks and deletions wait for approval. See Approvals.

Notifications cannot be aimed inward. Webhook URLs are checked before CloudPilot will call them, and ones pointing at private, loopback or link-local addresses are refused — otherwise the notification feature would be a way to make the panel fetch things on its own internal network.

Signing in#

Passwords are checked against a bcrypt hash. An unverified email address cannot sign in. Signing in from a device CloudPilot has not seen sends a code to your email first. You can also sign in with an SSH key instead of a password.

The record#

Actions against servers, projects, databases, domains and team membership are written to the audit log, readable by every role. Deletes are recorded before they happen, so a delete that fails halfway still has a record of who asked.

The honest limit: CloudPilot records what happens through CloudPilot. Someone with their own SSH access to a server can act on it without the panel seeing anything. If the audit trail matters to you, keep direct SSH access narrow.

Reporting a problem#

Found something wrong? Contact support and say clearly that it is a security issue so it is routed accordingly. Please give us a chance to fix it before publishing details.