Server security platform built around least privilege
A deployment platform holds the keys to production, so it has to earn that trust with a clear design. This page explains exactly how Deployment reaches your servers, what it stores, what never leaves your infrastructure, and which controls your team gets to limit who can do what.
The security trade-off of every server panel
Any tool that deploys code needs a way into your servers. In many setups that means one shared SSH key copied to every machine, a root password in a spreadsheet, or a CI secret that can do anything anywhere. When someone leaves the team or a laptop is lost, nobody knows which access to revoke. A server security platform should shrink that blast radius, not widen it.
How Deployment accesses your servers
When you connect a server, the connect command creates a dedicated SSH key pair for that server only. The public key goes into authorized_keys on that machine, and the private key is stored encrypted on our side. A leaked key for one server therefore cannot open any other server.
- One SSH key per server, never shared across servers or customers
- Key-only SSH, password authentication disabled during provisioning
- Revoke access at any time by deleting the key in the panel or removing the line from authorized_keys
- Deployment connects only from a published list of IP addresses, so you can restrict SSH in your firewall to those addresses
Least privilege on the server
Each site runs as its own system user with its own home folder, release folders and process manager units. A compromised app can read its own files, not the files of the site next to it. Provisioning commands that need root run through a narrow sudo rule, and application processes never run as root.
Hardened by default
More on the baseline on vps management.
- Firewall with SSH, HTTP and HTTPS open and every other port closed
- Unattended security updates installed daily
- Databases bound to localhost unless you add remote access rules for specific IP addresses
- Redis bound to localhost with a password
- TLS everywhere with Let's Encrypt certificates renewed automatically
Encrypted environment variables
Environment variables are encrypted at rest with a per-organization key and decrypted only at deploy time, inside the job that writes them to your server. In the panel, values are masked by default and revealing one is recorded in the audit log. Before a deploy that changes variables, the panel shows which keys were added, changed or removed, without printing the values.
Roles and per-server access
Organizations hold servers and sites, and people get the smallest role that lets them work.
| Role | What it can do |
|---|---|
| Owner | Everything, including billing, SSO settings and deleting the organization |
| Admin | Manage servers, sites, members and integrations |
| Developer | Deploy, roll back, view logs and edit variables on the servers they are given |
| Viewer | Read status, deploy history and logs, no changes |
Access can be limited per server, so a freelancer or client sees only their own machines. Roles are available on Team, Agency and Enterprise.
Audit log
Every action that changes something is recorded with who, what, when and from which IP address: deploys and rollbacks, variable changes and reveals, server and site changes, member invitations and role changes, token creation and logins. The audit log is on Team, Agency and Enterprise, kept for the retention of your plan, and exportable.
Account protection, 2FA and SSO
- Two-factor authentication with an authenticator app for every account, enforceable for the whole organization
- Sessions you can review and end from your profile
- SSO with SAML on Enterprise, so access follows your identity provider and offboarding is one click there
- API tokens with scopes per resource and per site, see the deployment api
What we store and what stays on your servers
| Stays on your servers and in your accounts | Stored by Deployment |
|---|---|
| Application code and release folders | Repository URL and deploy settings |
| Databases and their contents | Encrypted environment variables |
| Uploaded files and storage | Encrypted per-server SSH private keys |
| Backups, in your own S3-compatible bucket | Encrypted cloud and git tokens |
| Application logs on disk | Deploy logs and metrics for your plan's retention |
| Servers, disks and snapshots | Members, roles and audit log |
Your customer data lives in your databases on your servers. Deployment streams logs to the panel for viewing and keeps deploy logs for the retention period of your plan, from 14 days on Starter to 2 years on Enterprise.
Your apps do not depend on our uptime
If Deployment is unreachable, your servers keep serving traffic, workers keep running and cron keeps firing. Only deploys, the panel and alerts pause. Nothing on your servers phones home to keep running.
Reporting a security issue
If you find a vulnerability in Deployment, write to support@deployment.sh with the details and steps to reproduce. We answer every report and fix confirmed issues with priority.
Which plan fits your security needs
Starter (49 USD a month, 24 USD billed yearly) includes per-server keys, hardening, encrypted variables and 2FA for a single member. Team (199 USD a month, 99 USD yearly) and Agency (499 USD a month, 249 USD yearly) add roles, per-server access and the audit log. Enterprise (1 499 USD a month, 749 USD yearly) adds SSO with SAML and an SLA of 99.9 percent. Details on PaaS pricing.
Can Deployment staff log in to my servers?
Access to keys is restricted to the deploy and provisioning systems and recorded internally. You can also remove the Deployment key at any time and nothing on your server keeps running through us.
Do you hold copies of my database?
No. Backups go straight from your server to your own bucket. We store the schedule and the result, not the data.
Do you have security certifications?
We describe our controls openly on this page instead of pointing to badges. If your review needs more detail, write to support@deployment.sh.
Can I try Deployment before I pay?
Yes, with the free one-time demo on the home page. Plans start at 49 USD a month, or 24 USD a month billed yearly.
Give production access the structure it deserves
Connect a server with its own key and give every teammate exactly the access they need.
Want to see a plan before connecting anything? Try the demo.
$ git push origin main
✓ build release 20261019-142210
✓ health check 200
✓ switch current 0.4 s
$