This page describes how Nodetonet protects customer data. It is written by the same people who wrote the code, not a compliance department. We try to be honest about the things we do and the things we do not yet have. If you find something missing — or something broken — email security@nodetonet.com or join our Discord.
Short version: EU-hosted infrastructure with strict access controls, TLS everywhere, bcrypt passwords, Stripe-tokenised card data, a per-account audit log you can read yourself, and a willingness to sign a DPA. We are not SOC 2 or ISO 27001 certified — we explain what we do instead, and what is still on the roadmap.
Infrastructure
The Nodetonet control plane, panel and database run on dedicated servers in EU data centres operated by a tier-3 European hosting provider. We do not use shared hosting. The architecture separates concerns by purpose:
- Control plane — panel UI, REST API, database (PostgreSQL). Handles accounts, billing, token management and device pairing.
- Data plane (edge servers) — the layer that actually proxies and tunnels your traffic. Edge nodes have no direct access to the panel database, so a compromised edge cannot read account credentials, payment references or billing history. See how Nodetonet routes traffic for the full architecture.
- Agent binaries — the Android app and Windows
.exethat run on customer-controlled devices. Agents authenticate to the control plane via a per-token secret; they cannot read other customers' data.
Backups of the primary PostgreSQL database run daily and are stored in a separate EU region, encrypted at rest with a key we control. Backup restore is tested monthly. Operating systems are patched on a rolling schedule — security patches are applied within 72 hours of release for any critical CVE affecting the running stack.
Production access is restricted to two engineers, each requiring a hardware security key. There is no shared sudo account and no JIT access path for support staff. If an engineer needs to inspect your account for a support reason, that action is recorded in the same audit log you can see in the panel.
Encryption
- TLS in transit, everywhere. All panel and API endpoints are HTTPS-only — HTTP requests redirect immediately with an HSTS header. Customer custom domains (used for HTTP tunnels) receive auto-issued Let's Encrypt certificates, renewed automatically before expiry. See Let's Encrypt auto-renewal for details.
- Hashed passwords. Account passwords are stored as bcrypt hashes with a per-record salt. We never see your plaintext password — not in logs, not in support tooling, not in backups. If you use social login (Google, Discord or GitHub), Nodetonet never receives your password at all — only the OAuth token the provider returns.
- Tokenised card data via Stripe. Card numbers never touch our servers. Stripe handles card capture and storage; we receive only a tokenised reference and use it to process prepaid top-ups. If you prefer a non-Stripe payment method, contact us.
- API tokens and device tokens. Tokens are stored hashed; you can view the full value only at creation time. Lost or compromised tokens can be revoked and re-issued from the panel at any time without affecting other tokens or proxy configurations.
- Proxy credentials. Per-client username/password authentication for your rotating proxy end-users is stored hashed. Per-client IP allowlists add a second factor — see IP allow/deny lists.
Access controls you can use today
These account-level controls are exposed in the panel and active for every account:
| Control | Where to find it | What it does |
|---|---|---|
| Audit log | Account settings | Records every meaningful action — token created, proxy modified, device paired, balance topped up — with timestamp, actor and source IP. Retained 30 days on the standard plan, longer on request. |
| Token rotation | Tokens page | Issue, view, revoke or rotate tokens at any time. We recommend a 90-day rotation cadence for production tokens. |
| IP allow/deny lists | Per-proxy settings | Restrict which source IPs may use a given proxy. Useful for locking a proxy to your CI runner's IP range. |
| Domain allow/deny lists | Per-proxy settings | Block or restrict which destinations a proxy may connect to — useful for scoping a client's usage. |
| Per-client quotas and expiry | Proxy clients modal | Cap bandwidth and set expiry dates per downstream client so over-use is impossible. See quota limits. |
| Thread limits | Proxy clients modal | Cap concurrent connections per client to prevent one tenant from exhausting the shared pool. See thread limits. |
Compliance and GDPR posture
We operate as a GDPR-aware service. The legal entity is in Europe, and all customer data remains in EU data centres. We can sign a Data Processing Agreement on request — email security@nodetonet.com and we will return the signed template within two business days. The standard DPA covers:
- Sub-processors: Stripe (payment), our EU hosting provider (infrastructure), and our transactional email provider.
- Data residency: EU only by default; talk to us before signing up if you need a different region.
- Breach notification: we will notify affected customers within 72 hours of becoming aware of a material breach.
- Your rights: data export and erasure on request.
What we do not have today: SOC 2 Type II, ISO 27001, HIPAA, FedRAMP. We are an early-stage product following industry best practices, not a certified vendor. If your procurement requires one of those certifications, we are not the right fit yet. SOC 2 Type I is on our 2027 roadmap once revenue justifies the audit cost.
What data we collect and why
We collect the minimum necessary to run the service:
- Account data — email, hashed password (or OAuth subject), billing address for invoicing.
- Usage data — bytes transferred per proxy, connection timestamps, device last-seen time. This powers your dashboard, quota enforcement and billing. See understanding your bills.
- Audit events — which IP performed which action, when. Retained 30 days.
- Support communications — emails and Discord messages you send us, retained as long as they are relevant for support history.
We do not sell data to third parties. We do not run ad networks. We do not profile your proxy traffic content — we see packet counts and byte counts, not payload.
Reporting a security issue
If you find a vulnerability, please email security@nodetonet.com with as much detail as you can — the endpoint, the reproduction steps and the potential impact. We respond within 48 hours with an acknowledgement and within 7 days with a remediation plan or explanation.
We commit to not pursuing legal action against good-faith security research that follows reasonable disclosure norms — no exfiltrating real customer data, no extended denial-of-service, no social engineering of staff.
Bug bounty
Our bug-bounty program is informal — we do not yet run on a third-party platform. If you report a valid, previously-unknown vulnerability we pay between $50 and $2,000 in account credit or bank transfer, depending on severity and real-world impact. The scope covers:
*.nodetonet.com— panel, API and public marketing pages- The Android agent app
- The Windows HTTP tunnel
.exeagent - The public REST API
Out of scope: clickjacking on logout or static marketing pages; missing rate limits on unauthenticated marketing endpoints; vulnerabilities in upstream third-party services such as Stripe or Let's Encrypt (report those directly to the vendor); findings that require physical access to a customer's own device.
If you want a more structured program with guaranteed SLA on payout timing, that is on our 2027 roadmap once we have a dedicated security engineer on staff.
Staying informed
Security-relevant changes — patch deployments, dependency updates for known CVEs, and any incident reports — are posted to our Discord server (#announcements) and to @nodetonet on X. If you have a question that this page does not answer, email security@nodetonet.com or visit our contact page.