KStack
Hosting, under control. The hosting control panel your customers log into, on servers you own: websites, mail, DNS, databases, backups, virtual machines, object storage and AI endpoints, with unlimited customers and sites. Add a server in one paste, give it a job, and it stays the way you set it.
Everything KStack does, area by area
From the first server you add to the reseller who sells under their own brand.
Add a server in one paste. It stays the way you set it.
Tick the jobs a server holds and KStack sets it up, keeps it that way, and tells you when someone changes it by hand.
Paste one command on a fresh server, then tick what it does: web, database, mail, DNS, backup, statistics or VM host.
Each server fetches its own configuration. The panel never connects into it and stores no password for it.
A setting changed by hand is put back on the next cycle and reported. A reinstalled server added again gets everything back.
Group servers by the datacentre they stand in. A site's database and mail are placed beside the site.
Every server gets a managed firewall whose open ports come from the jobs it holds.
Heartbeat, disk and health per server. Drain one to stop new work landing on it while everything there keeps serving.
Every website in its own container, with its own limits.
Customers choose their PHP version, run Node or Python, and can see whether their site is answering, checked from outside.
A CPU slice, a memory ceiling, a disk allowance and a process limit for every site.
Apache with .htaccess, OpenLiteSpeed, nginx, or LiteSpeed Enterprise with your own licence, chosen per server.
A PHP version per site from the ones you offer, Node and Python applications, and per-site cron and Redis.
Every site gets an address on the platform's own domain, and Check my DNS shows exactly which records to point here.
Issued and renewed automatically. HTTP/2 everywhere, HTTP/3 on OpenLiteSpeed.
A git remote whose pushes go live, refused if someone edited files on the server.
Applications in one action, and your own.
Each one is installed with its database and its first administrator, and checked before it is called installed.
Staging and push back, malware scanning, git deploy, and updates that take a backup first.
Installed with their database and first administrator, on PHP or Node.
Zephyr put on a virtual machine of its own by its own installer, for a customer who sells hosting too.
Your WordPress, with the plugins, theme, settings and starting content decided once, offered on every site's Apps tab.
Node or Python services you publish to customers beside the built-in ones.
A customer connects their own coding agent to one website. It writes to staging; a person publishes.
Mail on servers of its own. Every zone on every nameserver.
Mail never shares a server with websites, and a DNS record added once is published by every nameserver.
Mail, calendar and contacts at mail.yourdomain, in your brand. The same mailbox works in Outlook, Apple Mail and on phones.
SPF, DKIM, DMARC, MTA-STS and DANE published when the domain's DNS is on KStack, listed to copy when it is not.
Each sending address warmed up on a schedule the platform enforces and checked against blocklists.
Message for message from any IMAP server, folders, flags and dates intact, verified as it goes.
Switch it on per domain. The record for your registrar appears once every nameserver serves the zone signed.
Earlier versions of every zone restored in one click, and deleted domains kept for a window you set.
Restore is the product.
Pick any protected website, database or mailbox, see its moments, and bring one back.
A database and login per customer, a browser in the panel with import and export, and a dedicated instance where one is needed.
Rotated in one step, then stored encrypted and never shown again.
Standard, Busy site or shop, Light, Long-term archive, or your own schedule and retention. New sites and mail domains are protected automatically.
Each customer's backups under their own key, with a second copy in a bucket you own if you want one.
A real snapshot brought into scratch space and verified every week, oldest first.
Restore one file, or bring back a site, database or zone deleted within the retention window.
Unlimited customers. Resellers in their own brand.
Plans are bundles of allowances enforced the moment something is created, and every refusal says why.
Ready-made plans for shared and reseller hosting, managed databases, business email, DNS hosting and VPS, or your own.
Resellers hold customers, quotas roll up, and suspending an account suspends everything beneath it.
Colours, fonts, name, logo and sign-in page for your panel and every reseller's, with their own nameservers and panel domain.
Which allowance, which plan, which account, so nobody has to open a ticket to find out.
Users per account with two-factor sign-in, a sign-in history, and colleagues invited by email.
Zephyr works out of the box. Anything else connects through the API, with usage per month as CSV or JSON.
Secure by default. Measured, not claimed.
A compliance report built from what was measured, signed updates, and an API the panel itself uses.
ModSecurity with the OWASP rules per site when you switch it on; HSTS and security headers by default.
SFTP locked to the site's own files with keys only, FTP where a customer needs it, and two-factor sign-in.
A measured verdict per control: backups tested, backups current, sites isolated. GDPR erasure and an append-only audit log.
Every release is verified against the publisher's key before it is installed.
Virtual machines from cloud images, S3 object storage with hard allowances, and AI endpoints on your own hardware.
Ask answers questions from what the platform measured, and an MCP endpoint lets your own agent work through the API.