One SSH key on your server. Your secrets stay there.
PimiDeploy is a server panel, so it works as root on your server over SSH. This page says what it holds, what it never stores and how you take the access back.
In private testing. It already runs our own production.
The panel holds one key, stored encrypted
PimiDeploy is hosted by us at deploy.pimi.io. It reaches your server over SSH with one key per team. You paste the public half into the server yourself. The private half is stored encrypted.
It leaves no agent running. Each action uploads a script, runs it and shows you the output live, and every action goes on your team’s activity timeline.
A new server is locked down at its first provision
- Key-only SSH No password logins. Root signs in by key only.
- fail2ban An address with repeated failed SSH logins is banned.
- Automatic security updates Ubuntu’s security updates install daily, with no automatic reboot.
- A firewall On a single server, only SSH and the web ports are open.
- SSH logins by key onlyOn
- fail2banOn
- Automatic security updatesOn
- FirewallActive
Each is a switch. Before the panel changes SSH settings it checks it can still log in, and puts the old settings back if it cannot.
Your secrets stay on your server
Your app’s .env
Read from the server when you open the editor and saved to the server only. A file that breaks the app is put back.
WordPress admin passwords
Generated on the server during the install. You read it from the site’s page, then remove it from the server.
wp-config.php
Read from the server each time you open it. The panel keeps neither its values nor a copy.
Each site gets its own Linux user, PHP pool, database user and Redis user. Each site’s database, cache and secrets are its own. A command you run from the panel runs as that site’s user, never as root.
What the panel does store, encrypted: its SSH key, a GitHub token if you connect one, and the addresses your alerts go to. Deploy keys on GitHub are read-only, one repository each.
Start read-only. Leave with your sites running.
Start read-only
Connect a server you already run and the panel only reads: what is installed, the sites on it, their uptime, certificates and traffic. It refuses every change to a site it only watches, and such a site sends no alerts.
Leave cleanly
Remove a server and the panel forgets it. Nothing changes on the server: sites, databases, certificate renewal, cron jobs and workers keep running. One tick also deletes the panel’s key from the server.
What it does not do
- Ubuntu 24.04 only It sets up no other system.
- No deploys on a server it did not set up An existing server stays read-only. Taking one over is planned.
- No MCP server Planned. Scripts use the API today, with tokens that expire.
- No VPS or DNS management You create the server at your host and point your domains at it.
What it installs and what a deploy does is on how PimiDeploy works, step by step.