What RainServer can see, and what it never will.
A server tool that runs as root has to be boring and predictable about security. This is how RainServer 1.0 works.
What it can read
- System metrics: CPU, memory, disk, network, processes
- Service state and the systemd journal
- Package manager state (what is installed, what is pending)
- Docker state through the local socket, if Docker is installed
- Firewall, SSH and fail2ban configuration (read-only)
- Backup job results you point it at
What it never collects
- SSH private keys
- Passwords or password hashes
- Environment variables and application secrets
- Database contents
- Files in /home
- Anything the check does not need
The rules
No silent destructive actions
Anything that deletes, stops or changes something is shown to you first: the exact target, what will change, the risk, and whether it can be undone.
No arbitrary remote shell
The dashboard can request a fixed list of typed, versioned actions. Each one is checked against your policy and verified afterwards.
Everything is recorded
Every action keeps who asked for it, which policy allowed it, the target, the parameters and the result. The history cannot be edited from the dashboard.
Root, honestly
Some jobs need root. We will not pretend otherwise. We keep the always-running part minimal and make every elevated action visible, limited and logged.
Data handling
| Transport | HTTPS only, certificates validated, no plain-text fallback. |
|---|---|
| Agent identity | Each server gets its own secret. Removing a server in the dashboard revokes it without touching the others. |
| Actions | Every action and every licence the agent receives is signed with our Ed25519 key and checked on the server before it runs. |
| Accounts | Sign-in with a one-time code sent by email. No passwords are stored. Sessions end after 30 days. |
| Storage | Data is stored on our own servers, readable only by the RainServer service. Every query is scoped to your account and checked on the server side. |
| Logs | Passwords, tokens, keys and credentials in URLs are masked in log lines before they leave the server. |
| Updates | Signed releases and a signed update manifest. The installer and the updater check both the signature and the checksum. |
| Payments | Stripe handles card data. We store a reference to your subscription, never card numbers. |
Security questions
Is RainServer an antivirus?
No. The security module checks configuration and posture: SSH, firewall, updates, open ports, permissions. It is not a malware scanner, an intrusion detection system or a replacement for a security team.
Do you have SOC 2 or ISO 27001?
No. We are a small team and we will not claim certifications we do not have. What we can do is publish how the product works and keep it inspectable.
Can the web dashboard run commands on my server?
Only actions from a fixed list, each with typed parameters, a preview and a policy check. There is no text box that sends shell commands to your server.
Report a security issue
Found something? Email security@raincleaner.eu. Every report is reviewed. Please give us a reasonable time to fix it before you publish.
Machine-readable contact: /.well-known/security.txt. Terms & privacy
Get it running on your server in two minutes.
- Create an accountSign in with your email. The 7-day trial for one server starts right away; no card.
- Add your serverCopy the install command from the dashboard and run it with sudo. It shows what it will install and checks the signature of the download.
- Open itRun
sudo rainserverfor the terminal dashboard, or open the web dashboard.
curl -fsSL https://raincleaner.eu/rainserver/install.sh | sudo sh -s -- --token YOUR_TOKENWant to read it first? install.sh · Install docs
- Ubuntu, Debian, Rocky, AlmaLinux, RHEL
- x86_64 and ARM64
- Removed completely with one command