Security

Your account

• Passwords are at least 12 characters, common passwords are refused, and we store only an Argon2id hash.
• Two-factor sign-in uses an authenticator app, with one-time recovery codes in case you lose the phone. Each code works once, so a code someone sees over your shoulder is useless to them. The secret is stored encrypted.
• You see every signed-in session in the console and can end any of them. Sessions end on their own after 30 days without use.
• We email you when your password, your email address or your two-factor settings change, so a change you didn’t make doesn’t go unnoticed.
• Password reset links work once, for 30 minutes, and using one signs you out everywhere.

Your servers

• A root password is generated for you from a secure random source and shown once. We keep it encrypted only until you confirm you saved it, then delete it.
• You can sign in with your own SSH key instead. The console refuses a private key pasted by mistake.
• Deleting a server needs its exact name typed, and a deleted server’s data is gone.
• Our server security guide walks through hardening a new server, step by step.

Our staff

• Staff sign in with a password and an authenticator code, every time. A code can’t be used twice.
• The staff console has its own sign-in and its own session, separate from customer accounts. A staff session ends after an hour without use.
• Staff have only the access their job needs. Support can’t touch money, prices or payment settings.
• Every staff action is recorded with who, when and why. Locking your account, resetting your two-factor or changing your balance is always emailed to you.
• Changing a crypto receiving address needs the owner and a fresh authenticator code, and the address is checked against its network before it is used.

The network and the machine

• Every server is a KVM virtual machine with its own kernel, not a container sharing one with its neighbours. What that means.
• Always-on DDoS filtering drops layer 3 and 4 floods before they reach your port, the same in every country. What it covers.
• Only outbound traffic counts toward your allowance, so incoming flood traffic doesn’t use it up.

Your payments

• Before a payment is credited, it is checked by a second, independent source, so one faulty or dishonest data source can’t credit an account.
• Stablecoins are accepted only from their issuers’ official contracts. A look-alike token sent to our address credits nothing.
• Every receiving address is checked against its network’s format before it is used, and changing one needs the owner and a fresh authenticator code.
• Monero payments are checked by a person, from the transaction ID and key you send, before they are credited.

Our own secrets

API keys and other production secrets never sit in our code. On the server they live in one file that only the application’s own system user can read, and every change to our code is checked for leaked keys before it can be committed.

Your data

IP addresses are stored hashed, not in clear. Secrets such as two-factor keys and root passwords are encrypted with AES-256-GCM. Our emails are plain text, with no tracking pixels. See the privacy policy for everything we hold.

Your half of the job

We secure the platform; what runs inside your server is yours. Four steps cover most of it:

1. Sign in with an SSH key, not a password: SSH keys on Windows.
2. Lock down SSH itself: SSH hardening.
3. Turn on automatic security updates: unattended upgrades.
4. Turn on two-factor sign-in for your LiteKeep account.

Reporting a vulnerability

Found a security problem in LiteKeep? Email [email protected] with “Security” in the subject, what you found and how to reproduce it. A person reads it and replies.

Please test only against your own account and servers, don’t access other customers’ data, and give us a reasonable time to fix it before you publish. We don’t run a paid bug bounty. Our contact details are also in security.txt.