Security model
Learn how your traffic is encrypted, what we can and can't see, how access stays closed by default, and what happens when someone leaves.
nixscale's security model rests on three principles: traffic is end-to-end encrypted, access is closed by default, and every network is isolated on its own.
Encryption
Connections between your devices are made with WireGuard and are end-to-end encrypted. The private half of the encryption keys never leaves the device; it's never sent to the network.
When a direct connection can't be made, traffic goes through a relay server. Even then the encryption is end-to-end: the relay forwards packets and can't see their content.
What do we see?
| We see | We don't see |
|---|---|
| The names, addresses and last-seen times of devices on the network | The content of traffic between your devices |
| Who is on which network, with which role | Your files, database queries or application data |
| A record of changes made in the panel (who did what, when) | Local data on your devices |
Which personal data we store, and for how long, is set out in the Privacy Policy.
Access is closed by default
A device joining the network grants it nothing. The policy is compiled from the rules you write and applied to the network's control server:
- With no rules, no traffic is allowed.
- Rules are one-way; only the protocols and ports you choose are opened.
- Every change produces a new policy version, visible in the panel.
- People's access is managed with people groups, machines' access with labels.
Network isolation
Every network has its own control server, its own database and its own IP block. Devices on one network can't see devices on another; there's no shared address space and no shared policy between networks. Two networks in the same organization are strangers in this respect too.
Device enrollment and keys
- Devices join with a key created in the panel that works once and is valid for 24 hours.
- The key is never emailed; the panel shows it masked.
- Using the key or letting it expire invalidates it; every device needs its own key.
- When someone is removed from a network or the organization, their unused keys are revoked too.
When someone leaves
Closing their access is a single step: remove them from the network or the organization.
| What happens | Details |
|---|---|
| Their personal computers are signed out | The devices move to Access revoked and can't reconnect |
| They're removed from people groups | The access those groups' rules granted ends |
| Their unused keys are revoked | Pending enrollments can't be used |
| Their labeled devices stay | Those are machines; delete them separately if needed |
Details: Members and roles.
Panel access
Signing in to the panel goes through an identity provider; we don't hold your password. Creating a network, sending an invite and accepting an invite all require a verified email address.
Permissions are enforced on the server: a button missing in the panel isn't an extra layer of security, it's a reflection of the rule on the server.