Accounts
An SFTP account maps to exactly one directory: a site document root, a game instance folder, or a subdirectory of either. The account cannot navigate above it, cannot see other accounts, and does not get a shell.
Accounts are created and revoked from the panel, which means giving a developer access to one site for a week is a two-minute operation rather than a system administration task.
Authentication
- Password authentication with generated passwords
- Public key authentication with multiple keys per account
- Optional IP allowlist per account
- Expiry date on an account, after which it stops working automatically
- Immediate revocation
Ownership and permissions
Files uploaded through SFTP land with the ownership the web server or the game instance expects, which removes the most common support question in shared hosting: the upload worked and the site returns 403.
The panel also exposes a permission repair action per site, which resets ownership and modes to the expected state after somebody has been experimenting.
Logging
Connections, authentication attempts and individual file operations are logged with the account and source address. Failed authentication feeds into the firewall’s ban rules, so a brute-force attempt against SFTP gets the same treatment as one against SSH.