Skip to content
launchroom
Install

Security

Your servers only take signed instructions.

The dashboard never logs into your servers. Each server fetches a signed description of what it should run, checks it against its own rules and applies it. There is no remote shell.

Read the docsInstall launchroom
Team security settings: server certificates set to Check, readiness for control plane, server-2 and server-3, an audit log verified with 614 chained entries and its signing key, and destinations for copies outside launchroom.Team security settings: server certificates set to Check, readiness for control plane, server-2 and server-3, an audit log verified with 614 chained entries and its signing key, and destinations for copies outside launchroom.

Servers

Nobody logs into your servers.

Someone with full control of the dashboard can still only ask a server for what its rules allow. Joining the private network gives no access by itself.
  • The dashboard signs every response, and each server signs its requests with its own key
  • Each server refuses privileged containers, host mounts and access to Docker itself
  • Docker is reached through a guard that allows only what launchroom needs
What launchroomd does

Audit log

An audit log you can verify.

Every deploy, change, console session and sign-in is recorded. launchroom shows when the log was last verified, and you can check it yourself.
  • A hash chain with signed checkpoints every ten minutes
  • The verifier names every edited, deleted or reordered entry
  • Forward to syslog, a signed webhook or append-only S3
Audit log
Activity page with filters for deploys, promotions, changes, team and alerts, an 'Audit log verified' badge, and entries such as a project created, an image deploying and resolved server-busy alerts.Activity page with filters for deploys, promotions, changes, team and alerts, an 'Audit log verified' badge, and entries such as a project created, an image deploying and resolved server-busy alerts.

Accounts

Two-factor, passkeys and scoped tokens.

Invite your team with roles. Sign in with an authenticator app or a passkey. API tokens belong to one team, carry explicit permissions and expire.
Two-factor authentication
Account security settings: change password, two-factor authentication on with an authenticator app and recovery codes, and a Passkeys section with Add passkey.Account security settings: change password, two-factor authentication on with an authenticator app and recovery codes, and a Passkeys section with Add passkey.

Details

Encrypted secrets
Encrypted at rest and never logged or returned by the API.
Networks per environment
Each project environment has its own network. Apps can’t reach launchroom’s own services.
Client certificates
Optional mTLS for every server connection, renewed every week.
Protected previews
Previews are behind a login or share link. Pull requests from forks never see secrets.
Signed releases
The installer and updates check release signatures before anything runs.
Open source
The code and the security model are in the public repository.

More of launchroom

Install it on your server with one command.

curl -fsSL https://launchroom.vantezzen.io/install | sh