Security
How we protect your data
Every provider key and customer record is encrypted and isolated. Here's a technical look at the controls that keep GOAT Panel — and your panels — secure.
Encryption at rest (AES-256)
Provider API keys and sensitive secrets are encrypted with AES-256 before they're ever written to the database, and decrypted only in memory when your orders run.
Encryption in transit (TLS)
All traffic runs over TLS with HSTS, so data is protected end to end between browsers, our API, providers and payment gateways.
Per-panel isolation
Every query is scoped by tenant. One panel can never read another panel's data, keys, orders or customers.
Access control & auth
JWT-based authentication with entity types (owner / staff / user) and granular, per-module staff permissions on a least-privilege model.
Payment integrity
Incoming payment webhooks are verified with HMAC signatures before they're trusted. We never store raw card data.
Abuse & DDoS protection
Cloudflare WAF and DDoS protection, per-IP rate limiting (with CF-Connecting-IP fallback), and Turnstile CAPTCHA guard against bots and abuse.
Hardened by default
Input sanitization, slug validation, strict CORS and security headers (X-Frame-Options, HSTS, and more) on every response.
Two-factor authentication
Owners, admins and staff can enable 2FA to add a second layer of protection to account access.
SSL & backups
Automatic SSL for every panel and custom domain via Cloudflare, plus regular, monitored database backups.
Found a vulnerability?
We appreciate responsible disclosure. Reach us and we'll respond quickly.