Built so your data never leaves your hands.
RackMon is self-hosted by design. It runs entirely on your infrastructure, and its security model assumes you — not us — are in control.
Self-hosted, no phone-home
- Your monitoring data (devices, metrics, alerts) stays in your own database on your own server. RackMon never sends it anywhere.
- There is no telemetry. The only optional outbound call is an update check — a plain
GETof a small public JSON manifest, off by default, that sends no data about your install. - The in-app support form only sends when a human clicks send — your message plus basic context (your email, RackMon version and edition, and an optional instance label) so we can help.
Secrets encrypted at rest
Device and SMTP credentials are encrypted with AES-256-GCM using a master key you provide (RACKMON_MASTER_KEY), which is kept out of the database. Session tokens are signed with a separate secret (RACKMON_JWT_SECRET).
RACKMON_ENVIRONMENT=production, RackMon refuses to start while any security-sensitive value is still on its insecure development default — so a misconfigured instance fails closed instead of running exposed.Authentication & access control
- Password login with lockout after repeated failures; TOTP two-factor available.
- API keys for automation, role-based access control (admin / operator / viewer), and a full audit log of sensitive actions.
- SNMP v3 (authPriv) for encrypted device polling.
- Pro: LDAP / Active Directory and OpenID Connect (OIDC) single sign-on, with ID-token signatures verified against the provider's JWKS.
License keys are offline and tamper-evident
Pro/Enterprise licenses are Ed25519-signed tokens verified offline inside your instance against an embedded public key. There is no license server to call and nothing to leak. The private signing key lives only on our side and is never shipped in the product image.
Transport & deployment
- Run RackMon behind a TLS-terminating reverse proxy (Caddy, nginx, Traefik) so all traffic is HTTPS.
- The container runs as a non-root user. Expose only the ports you need.
- Keep current:
docker pull rackmon/rackmon:latestto receive security fixes.
Payments
We never see or store your card details. Checkout is handled by our Merchant of Record, Lemon Squeezy, which processes payments and is PCI-compliant.
Reporting a vulnerability
Found a security issue? Please email rackmon.software@gmail.com with details and steps to reproduce. Give us a reasonable window to fix it before public disclosure — we'll acknowledge your report and keep you posted. We're grateful for responsible disclosure.