Security
Security your server checks for itself.
Unrent never holds an SSH key or password for your servers. The agent connects out, accepts only signed jobs with a fixed schema, and verifies a passkey approval itself before anything destructive, so even a compromised Unrent cannot destroy your data.
- Your agent asksdeploy · production/web
- Unrent signs the job and holds itNothing is sent to the server yet
- You approve with your passkeyYour passkey signs this exact job
- Your server checks, then actsThe agent verifies every signature
What Unrent can and cannot do
No inbound access
The agent dials out over a websocket. There is no listening port, no SSH key and no remote shell.
Signed, typed jobs
Every action is a job kind with a strict schema, signed for your organisation. Commands are built from typed fields, never strings.
Passkey approvals
Restoring over production, changing where backups go or downgrading the agent needs an approver’s passkey over that exact job, checked by the server.
Secrets sealed in your browser
Values are encrypted to keys only your servers hold. Unrent stores ciphertext and cannot read it.
Two processes on the server
unrentdtalks to the network without privileges. The root helperunrent-exechas no network and re-checks every signature.Tamper-evident audit
Every job, approval and result is recorded in a hash chain with the server’s own signature on results, and can be exported and verified offline.
Server hardening you can read before it runs.
On Ubuntu 24.04 or 26.04, or Debian 12 or 13 (amd64 or arm64), Unrent checks eight things and shows a plan of every change before applying it: firewall, SSH (no passwords, no root password login, with a lock-out guard), unattended upgrades, Docker live-restore and log limits, swap, time sync, journal size, and a firewall for published container ports that Docker cannot bypass (it also keeps containers away from the cloud metadata address).
The agent re-checks every night and raises an alert if a hardened server drifts.
Coming A reboot window for kernel updates.
- Agent
- connected · manage mode
- Hardening
- 7 of 7 checks pass
- Inbound ports
- 80, 443
- SSH keys held by Unrent
- none
Your servers, your keys. Start with one free server.
The first server is free, then $2 per server per month, with nothing gated.