Security

Two-factor sign-in, tokens, hardening and what SrvYard stores.

Guides

Turn on two-factor authentication and manage your sessionsProtect your account with an authenticator app, passkeys and recovery codes, sign out devices you do not recognise, read the sign-in history, and require two-factor for a whole organisation.Keep API tokens safe and review the sign-in logGive each token one job, a short life and the fewest scopes, check Last used regularly, revoke what you do not need, rotate on a schedule, and read the sign-in log and the activity feed for anything unexpected.Harden your servers with the firewall, SSH keys and updatesWhat SrvYard already locks down on every server it provisions, and the checks that remain yours: keep ports closed, remove unused SSH keys, apply updates and reboots, protect databases and watch for change.What SrvYard stores about you and how secrets are protectedWhich credentials SrvYard keeps, which of them are encrypted, which are only hashed, what is shown once and never again, how logs are scrubbed and how to remove your data.Give people the least access they need and audit what they doChoose the right built-in role or build a custom one, limit members to teams, review who can do what each quarter and use the activity feed and the API log to see who changed something.

Frequently asked

How do I protect my account with two-factor authentication?

Turn it on in your account's Security page with any authenticator app, keep the recovery codes somewhere safe, and consider adding a passkey. Owners can require two-factor from every member of an organisation. See Turn on two-factor authentication and manage your sessions.

I lost my phone. Can I still sign in?

Yes, with a recovery code: choose the Recovery code option at the sign-in prompt, then set two-factor up again on the new phone. If you have lost the codes too, nobody in your organisation can switch it off; contact support. See Turn on two-factor authentication and manage your sessions.

What credentials does SrvYard store?

It keeps what it needs to work, such as SSH keys and provider tokens, encrypted with the application's key. Values it only has to check, like API tokens, are hashed, and some are shown once and never again. See What SrvYard stores about you and how secrets are protected.

Can SrvYard staff read my .env file?

The value is encrypted at rest, which protects a leaked database but not a compromised application server. Ask support about your organisation's requirements for administrative access. See What SrvYard stores about you and how secrets are protected.

How should I look after API tokens?

Give each token one job, a short life and the fewest scopes, check Last used regularly and rotate on a schedule. Revoke what you do not need. Tokens are personal and lose their powers if their owner is removed. See Keep API tokens safe and review the sign-in log.

What does SrvYard lock down on a new server?

A provisioned server starts with password logins off, a firewall that denies everything except SSH, HTTP and HTTPS, and automatic security updates. Keeping it that way is yours: every port, key and package you add changes the picture. See Harden your servers with the firewall, SSH keys and updates.

How do I give people the least access they need?

Start with the lowest role that works and add access on request. A role decides what a person may do and a team decides what they may see, and a member needs both. Review the list each quarter. See Give people the least access they need and audit what they do.