IRIS Hosting Live In 5 Minutes

IRIS hosting on xCloud gives your analysts a self-hosted DFIR platform for shared incident cases, on your own domain. Deploy IRIS from the OneClick catalog and xCloud starts the pinned web app and worker beside a private PostgreSQL database and RabbitMQ queue, generates the administrator password, mounts persistent volumes and publishes the interface over HTTPS. There is no open registration, so the first visitor never becomes an administrator.

Deploy your IRIS

No terminal
No technical skills needed
No lock-in, cancel anytime

What is IRIS?

IRIS (DFIR-IRIS) is an open-source web collaborative platform that helps incident responders share technical details during investigations, so self-hosted IRIS is a self-hosted case-management system you run for your own analysts. Its README splits it into IrisWeb, the web application holding the web interface and database management, and IrisModules, extensions that let third parties process data through IRIS. It is licensed under LGPL-3.0.

On xCloud this template deploys IRIS v2.4.29 as the official images, pinned by digest: the web app, a worker, PostgreSQL and RabbitMQ, with the last two private to the install. Four volumes hold the database, uploaded evidence, user templates and server data, and HTTPS is on your domain. The upstream TLS container is not used, and IRIS's own login is the only access layer.

From Sign-Up to a Live Case Platform In Just 3 Easy Steps

An IRIS stack normally means a web application, a worker, a database, a message queue, volumes, generated secrets, a domain and a certificate before the first case. This is the same result without assembling any of it.

Step 01
Sign Up
Create your xCloud account and pick IRIS from the OneClick catalog. Choose your domain and target server — there are no extra fields to fill in, because xCloud generates the credentials.
Step 02
We Deploy It For You
One click. We bring up the official IRIS web app and worker, pinned by immutable digest, with PostgreSQL and RabbitMQ kept private with no host ports, mount the db_data, iris_downloads, user_templates and server_data volumes, generate the administrator password and publish IRIS over HTTPS on your domain.
Step 03
Open IRIS And Start A Case
Save the administrator password from the protected credentials panel, open your HTTPS IRIS URL (first boot can take a few minutes) and sign in as administrator. Create your first case, then add assets, IOCs, notes and tasks to it.

Everything IRIS Does, On Your Own Server

IRIS runs in full here: a shared investigation workspace for your analysts, backed by a database and queue you own.

Shared Incident Response Cases
Analysts work on the same investigation, sharing technical details as a case rather than passing files around.
Assets, IOCs And Evidence
Record assets, indicators of compromise, notes, timelines, evidence and tasks against each case.
Background Worker And Queue
A worker consumes jobs from RabbitMQ, which is how IRIS modules process data such as enriching IOCs, without blocking the web interface.
Modules For Third-Party Tools
IRIS ships with default modules and lets you configure and enable them under Manage > Modules to process data via other tools.
Local Login, No Open Registration
Only accounts created by an administrator can sign in. Optional two-factor authentication and OpenID Connect settings are available in the app configuration.
Persistent Case Data
The database, uploaded evidence downloads, user templates and server data each live in a named volume, so a test case and IOC survived a container restart in QA.

Everything You Need To Run Your Case Platform 24/7

Managed hosting for IRIS, so the parts that keep it online are not your problem.

IRIS v2.4.29 deployed instantly
Official images pinned by digest
Administrator password generated for you
PostgreSQL and RabbitMQ kept private
Free SSL certificate
Server backups and snapshots
Server security updates included
30+ server locations
Unused balance refunded

What You Can Do With IRIS

Run investigations as shared cases
Give every incident its own case that all assigned analysts can read and update, instead of splitting findings across personal notes.
Keep IOCs and assets together
Record the assets involved and the indicators of compromise found, next to the notes, timeline and evidence that explain them.
Track tasks and timelines per incident
Assign tasks and build a timeline on the case so the state of an investigation is visible without asking around.
Process data with modules
Enable IRIS modules and let the background worker handle jobs through the queue, such as enriching IOCs, without tying up the web interface.

IRIS vs Alternatives

ServiceNow Security Incident Response: If you are weighing ServiceNow's incident response product, IRIS is LGPL-3.0 software you run yourself, with cases, assets, IOCs, timelines, evidence and tasks stored on a database and volumes you control.
TheHive: TheHive is a separate incident response platform and a different server and interface. This template runs IRIS, whose README describes a web platform for sharing technical details during investigations.
Timesketch: Timesketch is a separate forensic timeline tool. IRIS tracks whole cases, with assets, IOCs, notes, timelines and tasks, so pick the tool that matches how your team works.
Spreadsheets and shared documents: Common for small teams, but they have no built-in structure for cases, assets, IOCs, timelines or evidence. IRIS provides each as a record on a case.

Simple Pricing. Everything Included.

Dedicated Cloud VPS sizes, pre-configured for IRIS hosting. Pick the one that fits, and resize any time.

Cloud VPS 6 GB

Cloud VPS 16 GB

More headroom if IRIS sits alongside other security tools.

$59.99per month

16 GB RAM
6 vCPU cores
200 GB NVMe SSD
30 TB
Unlimited

Get started

Every size is a dedicated Cloud VPS we provision, patch, monitor and restore. Billed monthly with no lock-in — delete the server and the unused balance comes back to your account. IRIS itself is licensed by its maintainers under LGPL-3.0.

Docker hosting

Already Have a Server? Bring Your Own

Connect any VPS — DigitalOcean, Vultr, Linode, AWS, Hetzner or bare metal — and deploy IRIS on it through the same panel, for a per-server management fee instead of a Cloud VPS rental.

Free

Start your journey without cost.

$0forever

1 server
10 sites

Start free

Starter

Professional

The same platform, discounted at 6–10 servers.

$4per server / month

6–10 servers
Unlimited sites
All features included
Bring any VPS provider

Get started

Agency

The same platform, discounted at 11+ servers.

$3per server / month

11+ servers
Unlimited sites
All features included
Bring any VPS provider

Get started

Priced per connected server, so your rate adjusts automatically as you add or remove servers. You pay your own provider for the server itself.

Self-managed hosting

Ready To Run Your Own Case Platform?

IRIS on xCloud runs on a dedicated Cloud VPS that we provision, patch, monitor and restore. Deploy faster. Own the server. Stay in control.

Fast Provisioning
Deploy faster using an xCloud Managed Server built with optimized stacks and high-speed SSDs.
Enterprise-grade security
Protect your infrastructure with a free SSL certificate and more advanced security features at no additional cost.
Intuitive Control Panel
From Server creation to application deployment, everything can be managed from our intuitive control panel.

Hear what people are saying about us

See why agencies, developers, startups, and growing businesses choose xCloud to power their projects.

xCloud works really well, I am surprised by its performance being this the release version, I have tried many paid platforms such as runcloud, cloudpages or serveravatar, as well as free platforms such as CyberPanel, CloudPanel or Hestia Control Panel and direct competitors such as SpinupWP and FlyWP. Of all those that I have tried, the platform that works best for WordPress is SpinupWP and I believe that xCloud can reach and surpass that development, its roadmap is promising. Congratulations to the xCloud team, I hope they become the leading platform in the segment, it has all the potential to achieve it!

Brian Geovanny

I've been with runcloud for the last 3 years. However, after trying xcloud for the last month, I'm switching over. They are on a roll with their setup.

Kevin Pineda

I'm moving my servers to xCloud, a cloud control panel by M Asif Rahman and the WPDeveloper team. Their roadmap looks interesting and no, there are no team mates nor API limits with xCloud! #xCloud #wordpress #hosting

Leo Koo

How Cloud Nine Web Elevated Client Experience While Streamlining Hosting Operations using xCloud

Ed Ellingham

xCloud is like having an expert server team on call — without the big agency costs. It's given me back my time and given my clients peace of mind. Highly recommended for freelancers and small teams who want reliable performance and security.

Dumitru Butucel

xCloud isn't just a solution. It's like one of that friend who got your back when you screw things up pretty bad.

Waqar Ahmed

Trust me when I say, once people explore the potential of xCloud they gonna switch from other panels, just keep delivering the best tech, lots of love for the team 😍😍

Rahul Singh

So far my experience has been smooth like silk. I didn't imagine that configuring and managing a VPS would be so easy. As of today, I have deployed 8 sites. The support is good, and they treat users with respect, even if they ask stupid questions (myself included). For the future, I hope for greater flexibility in scheduled backups and more comprehensive and consistent documentation. I'm sure that within a few months, xCloud will become the leader in its segment. This community is amazing, and the Staff here is super helpful.

Massimo Villa

Came from cloudways then to runcloud then to xcloud. Looks like I'm staying here.

Gerson El

I've recently taken all of my Vultr-hosted sites and gotten rid of cPanel for them to substitute it with xCloud. I have to say, I'm really impressed with xCloud so far! The interface is definitely the standout feature for me.

Tony Lewis

I came from Cloudways and won't go back. Highly impressed with xCloud. Glad I gave them a chance.

Jared McDowell

I like xCloud better than RunCloud, but one thing I'll point out is that some years ago RunCloud was hungry for business, the support was outstanding, and the community was active and helped each other. Maybe it was sold, there was a change in management, or they stopped being hungry, but the quality of the RunCloud offering declined and it hasn't been moving forward quickly. My point is that currently the xCloud team has the edge and it is theirs to keep or lose

David McCan

How Kevin Heinrichs Cut Hosting Costs by 84% While Running WooCommerce & Node.js Sites Efficiently

Kevin Heinrichs

I had 150 sites on cloudways and am in the process of moving them to xcloud. Much faster and better priced.

Dan Spinoza

Dear xCloud Team, I have been using xCloud for some time now and am genuinely impressed with its capabilities and the flexibility it offers by allowing users to bring their own VPS for management. It's a fantastic service, and my experience so far has been very positive. Successful migrated 5 sites on a single server. Xcloud migration tool worked great. There were few hiccups with security plugin like MalCare but disabling the plugin prior to migration worked just fine.

Rahil Maknojia

Came from runcloud. Tried xcloud and never came back.

Karl Fanega

How Advanced Web Strategies Saved Over $2,000 & Recovered 56 Hours per Month Managing 70+ Client Websites

Gary Moody

xCloud gave me what no other hosting platform could: the flexibility of a VPS with the convenience of managed WordPress. As a solo founder running an entire business on one server, that combination is an important unfair advantage.

Jorge de los Reyes Martínez

I use Server Avatar and xCloud and I'll sooner use xCloud than Server Avatar personally.

Jay Pagano

How Newman Web Solutions Ensured Perfect Uptime and Seamless Scaling For 120+ WordPress Sites with xCloud

Lori Newman

I too have moved over to xCloud. It's pretty sweet. One click n8n and uptime Kuma apps

John Aperture

I went from Cloudways to xCloud. No intention on switching in the foreseeable future.

Blaine Moore

Frequently Asked Questions

Feel free to contact us with any questions or concerns you may have.

What is DFIR-IRIS used for?

DFIR-IRIS is used by incident responders to share technical details during investigations. Analysts work a case together, recording assets, IOCs, notes, timelines, evidence and tasks, and modules can process data through other tools. Here it runs on your own server with a worker and queue.

Is IRIS free?

Yes. IRIS is open source under LGPL-3.0, with the licence linked from this page at the pinned v2.4.29 tag. xCloud bills for the Cloud VPS under it, not for IRIS itself, and there are no per-analyst fees from the software. Review upstream terms before distributing modifications.

Can you run IRIS with Docker?

Yes, and this IRIS Docker hosting template does it for you. Upstream ships IRIS as Docker containers, and the template runs the official web app, worker, PostgreSQL and RabbitMQ images, pinned by digest, on your own server rather than an IRIS cloud account, with HTTPS in front.

Where do I find the IRIS administrator password?

In the protected credentials panel after install, with the username administrator. IRIS also prints it once in the application log at first boot, so treat container logs as sensitive. The value only applies when the account is created; change the password later inside IRIS, not in the environment.

Should IRIS be exposed to the internet?

Upstream advises against exposing it openly, because IRIS holds sensitive investigation data. This template adds no access layer beyond IRIS's own login, so consider enabling its two-factor setting and your own IP restriction or Basic Auth in front of the site.

Does IRIS have an API?

Yes. Upstream's README has an API section pointing to its documentation, and this install serves the web interface and API on the same HTTPS domain. Create analyst accounts inside IRIS, and keep API access to your own tools behind the same restrictions you apply to the interface.

How much RAM does IRIS need?

The template manifest asks for 2048 MB of RAM, 1 CPU core and 10 GB of disk across the app, worker, PostgreSQL and RabbitMQ; measured use in QA was about 1 GB with sample data. This page sells the 6 GB tier as the entry rung, leaving headroom as cases and evidence grow.

How do I back up IRIS?

Include four volumes in every backup: db_data (PostgreSQL), iris_downloads (uploaded evidence), user_templates and server_data, plus the stable generated values in the site environment. The platform does not do it for you, so dump the database with pg_dump, copy the other volumes, and test a restore.

Backups in xCloud

How do I upgrade IRIS?

Upgrades are not automatic. The template pins IRIS v2.4.29 and its images by immutable digest, and existing sites keep them. Back up first, read the upstream release and upgrade notes, then bump the readable tags and digests together on your own schedule. Do not change the secret key or salt.

Is registration open, and can I add two-factor sign-in?

Registration is closed: only accounts an administrator creates can sign in, so the first visitor never becomes an administrator. IRIS has optional two-factor authentication and OpenID Connect settings in its app configuration, but this template does not turn either on for you.

What runs alongside IRIS?

A background worker, PostgreSQL and RabbitMQ. The worker consumes jobs from the queue, which is how IRIS modules process data without blocking the web interface. The database and queue publish no host ports and are private to the install, and only the web interface is published over HTTPS.

Can I cancel anytime?

Yes. There is no lock-in — cancel any time. Hosting is billed monthly and charged for what you actually use, so when you delete the server the unused balance is refunded to your account, less up to 10% in payment-processing fees.