Multi-tenant isolation as a first-class requirement, not an afterthought
vcontrol is early-stage software. This page states plainly what is actually built and verified, and what isn't — no unearned certifications, no invented claims.
What's built and verified
Password hashing
Argon2id, not the weaker default many auth libraries ship with — verified by inspecting the real stored hash format, not just the library's docs.
Sessions and 2FA
Authentication runs on Better Auth, with TOTP and backup-code two-factor authentication available as a plugin.
Tenant isolation (BOLA-safe)
A request for a server outside a client's scope returns a plain 404 — never a permission error that would confirm the server exists, per OWASP API1 guidance. Covered by an automated integration test suite, not just manual checks.
Auditability
Every server action creates a task record and an audit event. Admin impersonation of a client session is handled by Better Auth's own mechanism, so every impersonated request's session names the real admin behind it.
How we verify it, not just claim it
- A dedicated integration test suite exercises cross-tenant access with a real database, not mocks — a client requesting another client's server must 404, and the suspended-account and locked-server cases have their own precedence rules under test.
- A background security review of the codebase previously found and fixed a real time-of-check-to-time-of-use (TOCTOU) race in client-attach logic, since closed with a database-level unique constraint and row locking, verified against real concurrent requests.
- Continuous integration runs the full test suite against a real PostgreSQL service container on every change, not only unit tests with no database.
Compliance
No certification is claimed until it is actually obtained.
- RoadmapSOC 2
- RoadmapISO 27001
- RoadmapGDPR data processing agreement
- RoadmapFormal penetration test report
Give your clients a real self-service portal for their Proxmox servers
Talk to us about running vcontrol in front of your own Proxmox VE cluster.