You are handing a key to a stranger. Here is what it can do.
This is what happens to that key, what separates your data from anyone else's, and — at the bottom — the controls we do not have.
yourpanel.com
Stored with AES-256-GCM. Used server-side only. Our API returns these last four characters and nothing else — to anyone, including you.
What your panel key can do here — and what it can never do on its own
The key you connect is a full panel admin key; we are not going to pretend otherwise. So the limit is enforced in our code rather than promised: nothing that runs on a schedule, no background engine and no AI path can create a panel account or add balance to a user. Those two actions happen only when you click them yourself in your own dashboard. A test asserts it and fails our build if it ever stops being true — which is the only kind of answer worth giving to a question about someone else’s money.
Panel keys are encrypted, and only ever used server-side
Your panel API keys are stored encrypted with AES-256-GCM under a key held in the platform environment, never in this repository. They are used only by the server when it talks to your panel. A key is never sent to a browser and is never written to a log in readable form.
Your data is scoped to your account on every query
Every read and write carries your tenant identifier, and the tables that hold customer data have row-level security switched on so a session cannot reach past its own account. The widget endpoints your customers hit resolve the account from the request rather than trusting anything the browser sends.
The chat widget is checked against your panel domain
When you connect a panel you give us its address. Requests from the chat widget are checked against that address, and a session is bound to a single-use token issued for one page load — so a copy of your embed code pasted on another site does not get a working chat.
A customer proves the order is theirs before it is discussed
Order numbers on an SMM panel run in sequence, so an order number alone is a guess anyone can make. Pilot Chat asks for the order and one fact from that same order the owner would know. Until both match, it will not confirm the service, the quantity or the status.
Rate limits and lockouts on the customer-facing endpoints
The endpoints your customers can reach are rate limited, and repeated failed attempts from one address are locked out for a period. This is there to stop someone walking through order numbers to see what the chat will tell them.
We watch our own background jobs
Every scheduled job records when it last completed, and a watchdog raises a fault when one stops finishing. This is not a marketing line: it is how we found that our own service monitor had been dead for 82 days while every dashboard looked healthy. It now says so instead.
What we do not claim
PanelPilot is new. These are the things a larger vendor would list and we cannot.
- No SOC 2, ISO 27001 or PCI certification. None has been attempted.
- No uptime SLA. Uptime is not measured, so it is not promised.
- No per-user audit trail yet. Actions are not attributed to the individual staff member who took them.
- No independent penetration test has been carried out.
Found something, or need detail for a review?
Security reports go straight to the person who wrote the code.
Get in touch