Security and privacy
Nardeboon is built so that nobody in the middle can read your traffic, including us.
End-to-end encryption
Traffic between your devices is encrypted with unmodified WireGuard: Noise IK, Curve25519, ChaCha20-Poly1305 and BLAKE2s. Only your devices hold the keys.
Relays can't read anything
Relays forward packets that are already encrypted. They never have keys, never see content, and never connect two different networks.
Disguise without weakening
The obfuscation layer sits outside WireGuard and has its own keys. It hides what the traffic looks like; it never replaces the encryption.
Resistant to probing
Connections prove they know a secret in their first bytes. Probes get no answer on UDP and an ordinary website on TLS, and recorded traffic can't be replayed.
No silent downgrades
Each device publishes its transports and obfuscation versions in a signed network map. Both ends compare what was promised with what is used, and close the connection if they differ.
What we never collect
We never collect the content of your traffic or your DNS queries. Telemetry is limited to what the dashboard needs, such as path quality and relay usage.
Signed updates only
Devices install only releases signed by Nardeboon. An update from the dashboard can request a signed version; it can never run a command on your device.
Independent of our servers
If our control plane becomes unreachable, devices keep running on their last signed configuration, even after a reboot, and keep trying every route back.
Your keys, your control
Keys can expire, be revoked instantly or require re-authentication. Admins can require approval for new devices and users.
Account security
Two-factor sign-in with authenticator apps and passkeys. Teams can require MFA or SSO for everyone.