/securitySecurity & privacy
Security isn't a feature. It's the default.
Least privilege, least data, deny by default, auditable. Here is what CoderBoost does for devices, sessions, nodes and releases.
Design principles
Least privilege, least data, deny by default, auditable.
Device credentials
Each device has its own key. The private key is generated locally and the server keeps only the public key; the database refuses to store private keys. The client keeps credentials in the system's secure storage, and if that is unavailable it keeps them in memory only, never in plain text.
Sessions
Login credentials are short-lived and renew automatically. Changing your password, removing a device or a ban revokes every related session and credential immediately.
Node authorization
Nodes hold only access leases, never the user database; revocations sync in real time through an event stream.
Local proxy
Listens on loopback only. When shared with containers and VMs, only private ranges are allowed and separate credentials are required.
What we don't record
We do not record the content of the pages you visit. For billing and troubleshooting we process usage data such as connection time and traffic. The privacy policy has the details.
Admin permissions and auditing
Admin access is granted by role and capability, and every sensitive action is written to an append-only audit log.
Release security
Client release manifests are signed, the download page shows SHA-256, and failed updates roll back automatically.
Compliance
Only lawful resources are accelerated, with URL-level controls, in line with applicable laws and regulations.
Security disclosure
Found a security issue? Contact us through a support ticket with "Security" in the title.
Ready to stop waiting on the network?
Sign up in a minute. Connect in one click.