Managed OpenClaw VPS Security Checklist
An OpenClaw agent is an unusual thing to secure. It holds your AI provider keys, it keeps conversation history and memory on disk, it is reachable from public messaging channels, and it can be given permission to act on your behalf. That combination deserves a real checklist rather than a badge. Below are the ten controls that matter in production, what each one protects against, which ones OneClickClaw operates for you, and which ones remain yours no matter who hosts it.
Use it either way. If you self-host, treat every row as your own to-do list. If you host with us, the middle column is already done and the right-hand column is what to spend your attention on. The split is the point: managed hosting shifts a category of risk, it does not delete risk.
The checklist
Server isolation
What it protects against: On shared hosting or a shared container, another tenant's compromise can become yours, and your agent's memory and keys sit next to code you do not control.
Handled by OneClickClaw
Every plan runs on its own dedicated single-tenant VPS in Denmark (EU), on Webdock AMD EPYC hardware. No shared memory, disk, or process space, and no cross-tenant data path.
Still yours
Deciding what the agent is allowed to reach from that server, and not installing anything on it you would not trust with your keys.
Transport encryption
What it protects against: An agent gateway reachable over plain HTTP exposes tokens and message content to anyone on the path.
Handled by OneClickClaw
TLS 1.2 or higher in transit. HTTPS certificates are issued and renewed for you, and the firewall is configured at the platform level from day one.
Still yours
Using the HTTPS address you were given rather than the raw IP, and not disabling transport protections on your own server.
AI provider key storage
What it protects against: A leaked model API key is a direct financial loss and, depending on the provider, access to your account's other data.
Handled by OneClickClaw
BYOK keys are encrypted (AES/Fernet) before transmission and stored only on your own dedicated VPS, never in a central store, and never accessed in plaintext by us.
Still yours
Creating a dedicated key for the agent rather than reusing one, setting a spend limit on it, and rotating it if you ever suspect exposure.
Patching and updates
What it protects against: An unpatched Node runtime or an old OpenClaw build is the most common way a self-hosted agent gets compromised, precisely because nobody is watching it.
Handled by OneClickClaw
Automatic updates to stable OpenClaw versions, with SSL and firewall managed for you, plus DDoS protection, rate limiting and input sanitisation at the platform level.
Still yours
Reading release notes before enabling anything new, and telling us if an update ever breaks your workflow so it can be rolled back from a snapshot.
Backups you can actually restore
What it protects against: Agent memory, configuration and channel setup represent real work. An untested backup is not a backup.
Handled by OneClickClaw
Automated backups on all plans, daily or weekly depending on tier, retained in the same EU region, alongside a three-tier snapshot policy (initial, weekly, pre-update).
Still yours
Keeping your own copy of anything irreplaceable that you put on the server, and knowing which conversations you would actually miss.
Administrative access
What it protects against: A permanently open SSH port with password login is the oldest way in there is.
Handled by OneClickClaw
Customer SSH access is optional, opt-in, free and off by default. Our own infrastructure access is restricted to authorised personnel, and we do not access your business data, conversations, AI responses or files except on a monitoring alert or a valid legal request.
Still yours
Leaving SSH off unless you need it, protecting the private key if you turn it on, and turning it off again when you are done.
Channel access control
What it protects against: This is the one people miss. A Telegram bot is addressable by anyone who guesses or finds its username, so an unrestricted bot is a public front door to your agent.
Handled by OneClickClaw
Channel tokens are validated and pushed to your server over the managed pipeline, and OpenClaw's Telegram pairing step means a new chat has to be approved from your dashboard before the agent will talk to it.
Still yours
Approving only pairing codes you recognise, keeping the bot token secret, and thinking carefully before adding the bot to a group where you do not control the membership.
Agent permissions and untrusted input
What it protects against: An agent that reads web pages, files or messages can be told what to do by that content. Broad tool permissions turn a prompt-injection attempt into a real action.
Handled by OneClickClaw
The platform hardening is ours: rate limiting, input sanitisation, and a gateway that is not exposed for anonymous control.
Still yours
This one is genuinely yours and no hosting provider can take it: decide what the agent may execute, which directories it may touch, and which integrations it may call. Grant the narrowest set that does the job.
Monitoring and what it sees
What it protects against: Monitoring you cannot inspect is its own trust problem, especially for an assistant that handles personal messages.
Handled by OneClickClaw
Metadata only, and the list is published: SSH session metadata, network connections (destination IPs, ports, byte counts, never packet contents), filesystem metadata (names, sizes, timestamps, never contents) and listening ports with process names. Monitoring metadata is deleted after up to 90 days.
Still yours
Reading that list before you decide we are trustworthy, rather than after.
Incident handling and exit
What it protects against: The questions that matter on your worst day are: who tells me, how fast, and can I get my data out.
Handled by OneClickClaw
Notification without undue delay, and where we are controller, the supervisory authority within 72 hours; our authority is the Hellenic Data Protection Authority. On closure, BYOK keys are deleted with the server and account data is deleted within 30 days.
Still yours
Knowing where your export lives before you need it, and keeping the email address on the account current.
What managed hosting does not fix
Four risks survive any hosting decision, and it is worth naming them plainly rather than leaving them to be discovered.
Prompt injection. If your agent reads a web page, a document, or a message from someone else, that content can contain instructions. No infrastructure control filters intent. The mitigation is permission scope, not hosting.
Over-broad permissions. An agent allowed to run arbitrary commands will eventually be asked to. Grant the narrowest capability that does the job.
A leaked bot token. Anyone holding your Telegram bot token controls that bot. Treat it like a password, and regenerate it through BotFather if it is ever pasted somewhere public.
Your own key hygiene. We encrypt the key and keep it on your server, but we cannot stop a key that was already shared elsewhere from being abused there. Use a dedicated key with a spend cap.
For the software's own security model, OpenClaw publishes official security documentation. For our policies, sub-processor list, and data handling in full, see secure OpenClaw hosting.
OpenClaw security FAQ
- Does managed hosting make OpenClaw secure by itself?
- No, and anyone who tells you otherwise is selling. Managed hosting removes a specific and large category of risk: unpatched software, misconfigured firewalls, expired certificates, missing backups, and nobody watching the server. It cannot decide which tools your agent is allowed to run, who may message your bot, or whether the API key you connected has a spend limit. Those stay yours, which is why this page lists both columns.
- Where exactly do my AI provider keys live?
- Encrypted on your own dedicated VPS and nowhere else. Keys are encrypted before transmission and are never held in a central store or accessed in plaintext by us. Your AI provider acts as your own sub-processor, not ours.
- Is OneClickClaw SOC 2 or ISO 27001 certified?
- No. We do not hold either certification and we will not imply that we do. What we can point you to is concrete and verifiable: dedicated single-tenant EU servers, published sub-processors, a documented monitoring scope, encryption in transit and at rest, and a stated incident-notification commitment. If a formal certification is a hard procurement requirement for you, we are not the right fit today.
- Can OneClickClaw staff read my conversations?
- We do not access your business data, conversations, AI responses or files, with two stated exceptions: a monitoring alert that requires investigation, or a valid legal request. Routine monitoring collects metadata only, and the exact fields are listed on the security page rather than described vaguely.
- What is the single most important thing I should do myself?
- Restrict who can talk to your agent, then restrict what your agent is allowed to do. Almost every serious incident involving an AI agent starts with one of those two being wider than the owner realised.
- Where is the official OpenClaw security documentation?
- OpenClaw publishes its own security guidance at docs.openclaw.ai/security. It covers the software's own model and is the right reference for anything below the hosting layer. This checklist is the layer above it: who operates each control once the software is running in production.
Keep exploring
- Secure OpenClaw hostingOur full security posture: isolation, encryption, sub-processors, and GDPR rights.
- Managed OpenClaw VPS hostingThe dedicated EU server the managed column runs on.
- OpenClaw cost guideHosting versus AI usage, and how to cap the variable bill.
- API key security in depthHow BYOK keys are encrypted, stored, and rotated.