Security baked into
every layer
We don't just expose the security switch — we tell you which way to flip it. From firewall defaults to credential separation, SharkCluster ships with opinionated security guidance at every step.
Firewall
UFW, closed by default
SSH Keys
Scoped, masked, managed
Services
Localhost-bound by default
File Access
Sandboxed to app root
Monitoring
Health alerts & audit logs
SSL/TLS
Free Let's Encrypt + Cloudflare
Account
2FA, passkeys, SSO, lockout
0
Ports open by default
7
Security layers
3
Account auth methods (2FA, passkeys, SSO)
100%
Data on your VPS
Seven layers of security
From the firewall to the file manager, every layer is designed with a closed-by-default posture. The panel doesn't just expose the switch — it tells you which way to flip it.
Closed-by-Default Firewall
UFW rules, country-based filtering, CIDR ranges, rule sync
Scoped Deploy Keys
Per-repo SSH deploy keys, masked public keys, generate or upload
Localhost-Bound Services
Redis, RabbitMQ, OpenSearch — localhost by default with credential separation
Security Audit Log
Every request parsed — status, method, path, IP, user agent
Sandboxed File Manager
Server-enforced app root boundary, htdocs-only editing, Monaco editor
Account Security
2FA, passkeys (WebAuthn), SSO, failed-login tracking with lockout
Closed-by-default firewall
Nothing is reachable unless you explicitly open it. UFW rules are written in the panel and pushed to the actual machine. The panel and the live machine can drift — Sync Rules reconciles them. Country-based rules are approximate and labeled as such.
- Inbound and outbound rules with Rule Name, Type, Protocol, Port, Source/Destination
- Presets: HTTP, HTTPS, MySQL, PostgreSQL, DNS, or Custom
- Source: single IP, CIDR, 0.0.0.0/0, all IPv6, or country-based
- Action: Allow or Deny (deny carves exceptions out of broader allows)
- Status: Enabled/Disabled per rule (disable without losing config)
HTTP
TCP · :80 · 0.0.0.0/0
HTTPS
TCP · :443 · 0.0.0.0/0
SSH
TCP · :22 · 10.0.0.0/8
MySQL
TCP · :3306 · 0.0.0.0/0
Closed by default — open only what you need
Scoped deploy keys, masked SSH keys
Panel-generated deploy keys are scoped to a single repository — safer than a full-account access token. Three independently-gated permissions let admins grant terminal access without granting key management. Public keys are masked in the UI to prevent shoulder-surfing.
- Access_Keys — view and manage keys
- Access_Upload — add a key
- Access_Console — browser terminal access
- Generate keypairs — private key shown once, copy immediately
- Upload existing public keys — private key never touches the panel
prod-deploy
Access_Keysssh-ed25519 ••••••••••••••••••••••••••
repo: acme/web
ci-pipeline
Access_Uploadssh-ed25519 ••••••••••••••••••••••••••
repo: acme/api
dev-terminal
Access_Consolessh-ed25519 ••••••••••••••••••••••••••
repo: acme/web
Public keys masked to prevent shoulder-surfing
Security audit log — see every request
Every request that reaches your application is parsed into readable entries — who asked for what, what they got back, and what they were using. This is where you see scanning, probing, and brute-force attempts. A 2xx on a probe path is the real signal — someone succeeded.
- Status code, method, path, IP, timestamp, user agent, referer
- Color-coded status: green (2xx), blue (3xx), amber (4xx), red (5xx)
- Filter by level and search by IP, path, status, or user agent
- A 2xx on a probe path is the real signal — someone succeeded
$
Account security — 2FA, passkeys, SSO
Protecting the server is half the job — the panel account that controls it needs the same care. SharkCluster supports app-based two-factor authentication, passkeys, and single sign-on, with failed-login tracking and automatic lockout.
- TOTP two-factor authentication
- Passkeys (WebAuthn) — phishing-resistant
- SSO via Google, GitHub, LinkedIn and DigitalOcean
- Failed-login tracking with automatic lockout
Phishing-resistant authentication by default
Your VPS. Your data. Your rules.
Every application, database, and file lives on your server. We never have access to your data — only you do. The panel communicates with your server over SSH to manage it, but your application data, databases, and files never touch SharkCluster's own infrastructure.
Your data lives entirely on the VPS you choose
Panel communicates over SSH — your data never touches our infrastructure
Full server control — root access, SSH keys, firewall, file manager
Firewall
UFW, closed by default
SSH Keys
Scoped, masked, managed
Services
Localhost-bound by default
File Access
Sandboxed to app root
Monitoring
Health alerts & audit logs
SSL/TLS
Free Let's Encrypt + Cloudflare
Account
2FA, passkeys, SSO, lockout
Everything around your security
Pair security with the tools that keep your applications resilient and your team in control.
SharkCluster uses a closed-by-default firewall posture, scoped SSH deploy keys, localhost-bound services by default, a sandboxed file manager restricted to your application root, and proactive health alerts for CPU, memory, disk, and failed services.
No. Your data lives entirely on the VPS you choose. The panel communicates with your server over SSH to manage it, but your application data, databases, and files never touch SharkCluster's own infrastructure.
Yes, the firewall is closed by default. Nothing is reachable unless you explicitly open it. The panel provides built-in security guidance, including warnings against exposing database ports to 0.0.0.0/0.
Ready to take control
of your hosting?
Deploy servers, run self-hosted business apps, and keep your data on your own VPS — with a dedicated DevOps manager by your side.