Security
How PanelFi protects your servers, your customers and your licensing.
Account isolation
Each hosting account is confined to its own home, web server context and database grants, so one customer cannot read another's files or data.
Hardened by default
A firewall, ModSecurity with the OWASP Core Rule Set, brute-force protection, two-factor login and API tokens come built in.
Signed licenses
Entitlements are signed with Ed25519 and verified offline by the panel. The signing key never ships with the software, and keys can be rotated.
Signed releases
Updates are signed and verified before they are installed, and downgrades to vulnerable releases are refused.
Safe failure
If the licensing service is unreachable, your hosting keeps running — licensing never takes websites, email or databases offline.
Honest about limits
No licensing scheme makes self-hosted software tamper-proof. We aim for reasonable commercial enforcement with safe behaviour, and we document known limitations.