Data security
How Firepanel encrypts your credentials, what it can and can't see, and the infrastructure it runs on.
Security isn't a feature bolted onto Firepanel — it's the premise. You're trusting a third party with access to your production data, so this page spells out exactly what that access looks like. For the marketing-friendly summary, see the Security page; this is the detailed version.
How your credentials are encrypted#
The only sensitive thing Firepanel stores is your service account key. Here's precisely how it's handled:
- Encrypted at rest with AES-256-GCM. The JSON is encrypted on our server before it's written to the database. GCM is an authenticated mode, so tampering with the ciphertext is detectable.
- The encryption key is isolated. It lives in environment configuration, not in the database next to the encrypted data. A database leak alone does not expose your credentials.
- Decrypted only in memory, only when needed. When a request needs Firebase access, the key is decrypted in memory, used for that single request, and discarded. The plaintext never touches disk.
- Never sent to your browser. Decryption happens entirely server-side. Your browser receives data, never the key that fetched it.
The full request-by-request lifecycle is in How Firepanel works.
What Firepanel can see#
Being concrete about access matters. Firepanel can access:
- Your Firebase data — live, and only while you're using the app. Documents are read on demand and streamed to your browser. They are never copied onto our servers.
- Audit metadata — a record of which actions were taken in Firepanel and when, so there's a trail of changes.
- Your account info from Google sign-in: name, email, and avatar.
What Firepanel never does#
- It does not store your Firestore documents, Auth users, or Storage files on our servers.
- It does not sell or share your data with advertisers.
- It does not share your service-account credentials with any third party.
- It does not track you across other sites or run ad pixels.
Note
The simplest mental model: Firepanel holds an encrypted key to your data and uses it, in memory, to show you that data live. It never warehouses the data itself.
You're always in control#
- Disconnect any time. Disconnecting a project permanently deletes its encrypted credentials from Firepanel.
- Revoke at the source. Delete or disable the service account key in the Firebase Console and Firepanel instantly loses access — there's no cached copy of your data to fall back on.
Infrastructure#
Firepanel runs on named, auditable providers:
| Layer | Provider | What it holds |
|---|---|---|
| Hosting / runtime | Vercel | The application and edge network |
| Database | Neon Postgres | Account data, audit log, encrypted credentials |
| Authentication | Google OAuth | Sign-in (no separate password) |
| Payments | Razorpay | PCI-compliant checkout — we never see card numbers |
| Plunk | Sign-in alerts, receipts, contact replies |
Your Firebase data lives in none of these — it stays in your Firebase project.
Honest about our stage#
Firepanel is a young product. Security is built in from day one, but we don't yet hold formal certifications like SOC 2. We'll be transparent as that changes. If you find a security issue, please tell us — see Getting support for responsible disclosure.
Next#
Read exactly which service-account permissions are needed and why in Permissions.