Security that produces evidence, not just a green checkmark
xPanel's security model separates what the platform enforces on every account by default from what you configure for your own team and workloads. Both are documented plainly here — no fabricated certifications, no invented audits.
What you don't have to configure
These apply to every account on xPanel regardless of settings.
Authenticated control plane + signed webhooks
xPanel API actions require scoped bearer credentials. Outbound webhook deliveries can be HMAC-signed so a receiving system can verify that a delivery came from ScodyX.
Tamper-evident evidence ledger
Autonomy evidence is hash-chained and the console recomputes the chain when it verifies it. Altering a historical row or predecessor link is therefore detectable; this is a hash chain, not a claim that every row is independently signed.
Per-account isolation and quotas
Shared-hosting sites receive separate Linux users and document roots, disk and inode quotas, and PHP-FPM worker/memory controls. Those are the limits the current xPanel daemon actually enforces per site.
Hardened panel endpoint
Production xPanel installs bind the privileged daemon to loopback behind Nginx with ACME TLS, enable fail2ban and OS security-update automation, and use scoped bearer tokens for API actions.
What you configure
xPanel gives you the controls; how you use them for your team and applications is your decision.
Portal roles and scoped tokens
ScodyX organization roles govern portal operations, while xPanel node credentials use read, write and admin scopes. Assign only the access each operator or integration needs.
Multi-factor authentication
Users can enroll TOTP MFA through the ScodyX account security surface, and sensitive hosting actions can require a recent AAL2 verification. Organization-wide mandatory-MFA policy is not claimed here until that policy control ships.
Application-level access
SSH keys, database credentials and API tokens for your sites are yours to issue, rotate and revoke.
Have a security or compliance question?
Tell us what you need to verify about how xPanel handles access and evidence, and we'll answer directly.