Security
IPTV panel security that is built in, not bolted on
A compiled Go core instead of PHP, a database your panel alone can reach, releases that are signed and applied for you – and the daily controls of an IPTV service: who may watch, from where, on how many devices, and who changed what.
- No PHP, no plugin folder
- Updates applied by IPTVOS
- Your data on your server
- Go
- PostgreSQL 18
- Redis
- Caddy · TLS 1.3
- WireGuard
- Ed25519
- AES-GCM
- bcrypt
- TOTP
- ALTCHA
- no PHP
The stack
What runs, and who keeps it current
The panel runs with us, isolated per customer. Your servers run one static binary per role next to PostgreSQL, Redis, MediaMTX and Caddy – installed and updated from the panel.
- One Go binary per role
- Core, streaming agent and VPN agent are compiled Go programs. There is no interpreter on the web path and no folder of scripts a web server executes – a dropped file does not become a running backdoor.
- Updates applied for you
- IPTVOS updates every hosted panel. Your main server and load balancers update from one dialog; the agent, MediaMTX, Caddy and nzbfast are pushed from the main server’s release. A release that does not come up is rolled back automatically.
- Signed releases
- Packages and licences are signed with Ed25519; a server accepts only packages signed with the vendor’s key and refuses a changed download before it runs.
- PostgreSQL 18 on your server
- All your data lives in PostgreSQL on your main server, reachable by your panel only over TLS 1.3 with a pinned certificate. Every streaming server keeps its own copy of what streaming needs and plays on for up to 72 hours without the panel.
- HTTPS everywhere
- Caddy issues and renews certificates for the panel, your own domains and your streaming servers. The panel probes where players reach your servers and warns about plain http, a wrong chain or an expiring certificate – with the fix one click away.
- Sealed secrets, hardened servers
- Provider credentials and keys are sealed with AES-GCM, passwords hashed with bcrypt. The main server gets a firewall and fail2ban at setup; a viewer never sees line passwords.
Viewer access
Secrets per line and per device – not one shared door
A guessed MAC or a leaked playlist link is worth as little as possible: every line and every app device gets its own secret, and you decide what customers see.
Portal URL per MAG line
Every MAG line has its own secret portal address; “Generate new” cuts off every box still using the old one. The shared portal can be closed, so a MAC alone opens nothing.
App devices paired by code
An app device shows a 6-digit code valid for ten minutes; once paired it uses its own token – no username or password on the TV. Devices per line are limited, changes per day too, and a revoked device is out at once.
Hidden server, app-only mode
Hide the server address and playlist links from customers – and from resellers. App-only mode refuses M3U and Xtream Codes logins altogether; app devices and MAG boxes keep working.
A VPN that reaches only your servers
The app’s WireGuard tunnel is app-only: the server lets a device reach your panel, your streaming servers and DNS, and drops everything else. The panel computes and pushes that destination list to every VPN server.
Rules
Who may watch, from where
The Security page of the panel – enforced in real time on every streaming server, where the TV connects directly, from the server’s own local in-memory store (Redis): bound to localhost with a password, not reachable from outside and not shared between servers.
- IPs, networks, ASNs, user agents
- Block single addresses, whole networks or a provider by its AS number; refuse clients by user agent; a “never block” list protects your own addresses from every rule.
- VPN and proxy detection
- Built in: the network of an IP is checked against known hosting and VPN providers, fast and without an external service. Optionally proxycheck.io per IP, cached for a day, with the built-in check as fallback.
- ISP lock
- A line can be locked to the internet provider it is first used from – shared logins across households stop working. Reset the lock from the line or in bulk from Tools.
- Account sharing detection
- A line used from more IPs or countries within 24 hours than you allow is reported and marked in the list – or disabled at once, your choice. Restream suspects get their own page.
- Countries, connections, devices
- Allowed countries and IPs per line, connection and device limits per package or line, signed and expiring stream tokens – enforced where the stream is served.
- Brute-force bans and bot protection
- Too many failed sign-ins ban the address for a while. ALTCHA puts a proof-of-work puzzle on sign-in, registration, password reset and checkout – bots pay, people barely notice.
Backups
Backups you can rely on – and nobody else can read
Your panel's database is backed up twice: every night on your own main server, and as encrypted copies with us.
- Encrypted end to end
- The database is dumped over an encrypted connection and encrypted with AES-256-GCM on the way – it never lies on a disk unencrypted.
- A key for every copy
- Each copy has a key of its own, sealed with our master key and stored apart from the file. A copied file alone opens nothing.
- On a schedule and before every update
- Every 4 hours for 30 days (Enterprise) or daily for 14 days (Pro), plus a copy before every update and whenever you ask. Your main server keeps its own nightly copies for 7 days.
- Restore without risk
- A restore checks the whole copy first and backs up the current state before it starts, in one transaction: it works completely or changes nothing. Downloads and restores are logged.
Your team
Who did what – and who is restreaming
Visibility for you, limits for everyone with access to your panel.
Audit log
Every change and every sign-in: who, what, when, from where – lines, channels, settings, servers, credits. Passwords and keys are never stored in it.
Fingerprint per channel
Burn the usernames of chosen lines into one channel only – at most 20 copies at once, the rest in waves – to find out who restreams it.
Two-factor sign-in
TOTP codes from any authenticator app, with recovery codes. Sessions and API keys of an account can be closed from the panel.
Roles down the reseller tree
Team roles, super resellers, resellers and sub-resellers each see only their own lines; a reseller cannot lift a ban, and a viewer role never sees a line’s portal URL or password.
What we do not claim: no software is unbreakable, and we publish no vulnerability counts for other products. Security fixes reach a hosted panel as soon as we release them – that, and the controls above, is the promise.
Everything you want to know before you decide
Secure by design, updated by us
Try the panel for 40 days on your own server – no payment for the trial, your data stays with you.
30-day money-back guarantee · No setup fee · Cancel any time