The owner's guarantee

Five promises about how Citadel treats your server and your data. Each one is something you can check for yourself, and two of them are held in place by tests that fail our build if they ever stop being true.

These are the real reason to run Citadel rather than a panel that sits between you and your own server.

1. We never ask for your RCon password

Citadel reaches your server through one server-side mod, @CitadelAdmin, and the Citadel Server Manager next to it. Neither needs your RCon password, and there is nowhere in Citadel to enter one. Your players download nothing, and no admin credential to your game server ever leaves your box.

2. Nothing has to be open to the internet

Your server calls out to Citadel. Citadel never connects in. There is no port to open and no address to expose, so connecting a server never widens what the outside world can reach.

3. We never remove a player you did not

Citadel kicks or bans a player only when you, or a rule you set, did it. There is no Citadel-wide list that pulls people off your server on rules you cannot see, and no reserved-name or reputation kick applied on your behalf. Every place in our code that removes a player is covered by a test that fails the build if a new one is ever added without a permission behind it.

4. Everything is yours to export, any time

Your servers, your players and their history, your bans, tickets, staff, orders and the full audit trail export in one file whenever you want it, from Your data in the console. It is plain JSON that anything can read. The only thing left out is secrets, because a copy of a credential is a copy of a risk. Your ban list also exports on its own, as CSV or JSON.

It starts empty and is worth more the longer you run, and it is yours to keep whether or not you stay.

5. You can switch us off from your own box

You are never locked in. Turn off the Ops link in the Server Manager, or remove the key from the mod's configuration, and Citadel stops hearing from that server within a minute. Closing your whole account detaches every server and deletes nothing, so if you come back it is all still there. Any subscription is yours to cancel from Billing in your account, and it ends with the period you have paid for. Cancelling never has to go through us.

That is the whole of it. If any of these ever stops being true for you, it is a bug, and we want to hear about it.