Account & billing
Account and security
How a DediGPU account is protected: password rules, sessions, anti-robot checks and API tokens.
An account is an email address and a password. Because we send no email, some things work differently from the average hosting panel; this page lists them.
Password
At least 10 characters, typed twice at sign-up, hashed with bcrypt. Change it from Settings; changing it signs out every other session. Five failed sign-ins per email address or per IP address in an hour pause sign-in for the rest of the hour.
Lost passwords
There is no password-reset email and no recovery code. We hold an email address, a password hash and a balance — nothing that could prove an account is yours, and nothing we could write to.
Sessions
A session is a random token in a cookie, stored server-side as a hash, valid 30 days, bound to nothing else. Settings → Sessions signs out every other device. Signing out deletes the session.
Anti-robot check
Sign-up and sign-in carry a Cloudflare Turnstile widget. It usually completes without a click; it is the only third-party code on the site and it is loaded only on those pages.
API tokens
One token per account, issued from API and shown once; we store a hash and the last characters. Rotate it from the same page; the old token stops working immediately. Tokens are read-only today: see the API reference.
Event log
Settings → Activity lists sign-ins, orders, top-ups and key changes with the IP address and time. It is kept for twelve months.