Access
- HttpOnly and Secure cookie sessions, with CSRF protection
- Login attempt rate limiting
- Roles and permissions verified on every request
- API tokens with explicit scope, revocable at any time
Security
Concrete controls, not vague promises.
A platform with access to your servers must be designed to limit that access. Here is how SERVON does it — without absolute guarantees that nobody honest can make.
Security first
Tight control over who can change your infrastructure.
Security here is not a badge — it is concrete controls applied to every request and operation.
Roles and permissions
Each person has only the access they need, per organization.
Approval for critical operations
Restores, deletions, and production deployments wait for a human decision.
Immutable audit trail
Who did what, when, and where. The application cannot edit or delete the audit trail.
Encrypted secrets
Credenciais guardadas cifradas (AES-256-GCM), nunca devolvidas em texto simples.
Agent with signed commands
Every server request is signed, and only allowlisted actions are accepted.
Isolation between organizations
Each organization’s and customer’s data is isolated by default.
Em detalhe
Four layers of protection.
Operations
- Destructive operations require human approval
- An approval can only be decided once, even under concurrent requests
- Approvals expire if nobody decides on them
- Dedicated rate limits for risky operations
Servers
- Agent with signed requests (Ed25519) and replay protection
- Only allowlisted actions — no shell access
- Platform resources protected from agent actions
- The web service has no direct access to Docker in production
Data
- Secrets encrypted with AES-256-GCM and never returned in plaintext
- Sensitive values removed from logs
- Hash-verified backups copied off-server
- Audit trail that the application cannot alter
Responsible disclosure
Found a vulnerability?
Please report it privately before any public disclosure. Send the details and reproduction steps; we will confirm receipt and keep you informed of the fix.
Ready to take control?
Talk to us about your security requirements.
We answer security questionnaires and explain in detail how the platform is deployed and protected in your case.