Security, 2FA & Team Access
PanelOps implements defense-in-depth security controls to protect your infrastructure, authentication layer, and operational data.
🔐 Two-Factor Authentication (2FA)
Protect administrative and user accounts with Time-based One-Time Passwords (TOTP):
- Navigate to Settings → Security & 2FA (
/settings/2fa). - Scan the provided QR code with Google Authenticator, Authy, 1Password, or any standard TOTP app.
- Enter the 6-digit verification code to activate.
- Once active, all sign-ins will require your 6-digit TOTP code.
👥 Role-Based Access Control (RBAC)
Manage team permissions in Settings → Team (/settings/team):
| Role | Permissions & Scope |
|---|---|
| 🛡️ Admin | Full system access: server creation/deletion, global SMTP, team invites, billing, and system backups. |
| 👤 User | Can deploy App Store applications, manage assigned servers, create projects, and configure domains. |
| 👁️ Viewer | Read-only access: inspect monitoring metrics, view deployment logs, and review documentation. |
🛡️ IP Whitelisting & Anomaly Detection
- IP Whitelist: Restrict control panel access to specific static IP ranges or office VPNs.
- New IP Sign-in Alerts: If a sign-in is detected from an unrecognized IP address, a security alert is dispatched immediately to the user via Email, In-App, and Push notifications.
- Audit Trail: Every administrative action (server connection, password change, container restart, user deletion) is logged in the Audit Logs (
/settings/audit-logs) with timestamp, IP, and user ID.