SECURITY

You’re handing us the keys to production. Here’s how we look after them.

Kiln moves live sites between servers, so it is built to touch as little as possible, for as short a time as possible, and to keep your data between your own servers.

Your data

Data moves server to server, never through Kiln.

Kiln asks your new server to pull each database and folder straight from the old one over SSH. Database dumps and files go directly between your two servers: they never pass through, or are stored on, Kiln.

mysqldump is piped over SSH from the old server into the new database
Folders are copied with rsync, server to server
Database passwords are read on each server from its own .env, so they are never sent through Forge or left in its command history

Server access

Narrow, temporary access, removed when you finish.

To copy data, the new server needs to reach the old one. Kiln opens exactly that path and nothing more, then closes it.

An SSH key is generated on the new server, so its private half never leaves it
Only the public key is added to the old server, through your Forge account
Port 22 on the old server is opened to the new server’s IP address only
Both are removed when the migration finishes, or with one click if you abandon it

Your tokens

Encrypted at rest, used only for your migrations.

Your team’s Forge and DigitalOcean tokens are stored encrypted with AES-256 and never sent back to the browser. Each new site’s .env and the database password Kiln generates are encrypted the same way, and deleted as soon as they are on your new server.

A pasted token is checked with Forge before it is saved
Each team chooses which Forge organizations Kiln may use
Forge deploy webhook URLs, which can trigger a deployment, are never stored
Disconnect Forge or DigitalOcean from your team settings at any time

Accounts

Built to hold the keys to production.

Kiln can move live traffic, so every account is protected as if it were a production login.

Two-factor authentication is required for every account
Your password is asked for again before security settings change
Owner, admin and member roles: only owners and admins can connect accounts or invite people
Invitations are single-use, tied to one email address, and expire

Your old server

Nothing irreversible happens without you.

Until you press Switch over, your old server keeps serving every site as it does today. Kiln never deletes anything on it.

Every deploy script, .env, nginx file and cron command is shown for review before anything runs
At switch-over, sites go into maintenance mode while the final copy runs
Cron jobs and workers moved off the old server can be restored with one click
If you choose to power off the old droplet, you can power it back on from Kiln

Payments and the demo

No card details, no real servers in the demo.

Payments are handled by Stripe, who act as the seller and process your card. Kiln never sees or stores card details.

Stripe handles VAT and sales tax, and emails your receipts
The live demo runs entirely against simulated servers and never touches a real one
Demo accounts can’t connect real accounts and are deleted after a day

Security questions

Can Kiln see my site’s data?

Kiln reads what it needs from Forge to plan the move: each site’s .env, deploy script, nginx config and server settings, so you can review them. Your databases and uploaded files are copied directly between your servers and never pass through Kiln.

What access does my Forge token need?

Servers, sites, databases, SSH keys, firewall rules, scheduled jobs, background processes and site commands. The welcome steps list them when you create the token.

What happens to my tokens if I stop using Kiln?

Disconnect Forge and DigitalOcean from your team settings and Kiln deletes the stored tokens. Delete your account and Kiln deletes everything only you have access to. You can also revoke tokens in Forge and DigitalOcean at any time.

Does Kiln keep anything on my servers?

No. The temporary SSH key and firewall rule are removed at the end of each migration. If a migration is abandoned part-way, the migration page offers to remove them.

See exactly what Kiln does, first.

Try the live demo How it works