We believe that trust is earned through transparency. Here you'll find our vulnerability disclosure policy, the security standards we follow, and a clear view of how your data flows through our architecture.
How to report a security issue responsibly
We take the security of WireZTNA and our partners' data seriously. If you've discovered a vulnerability in our platform, we want to hear from you and will work with you to resolve it quickly.
In scope
Out of scope
Application Security Verification Standard — Level 2
WireZTNA's architecture is designed following the OWASP Application Security Verification Standard (ASVS) v4.0 at Level 2 — the recommended level for applications that handle sensitive data and require defense against the majority of application security risks.
Level 2 — Standard
Suitable for applications handling business-critical data
Level 2 covers most applications and APIs that process significant or sensitive data. It ensures defenses against the majority of risks found in modern software today.
Architecture & Threat Modeling
Zero Trust design with per-user policy enforcement
Authentication
OTP email + TOTP MFA, JWT with short-lived tokens
Session Management
Ephemeral PSK sessions with configurable TTL (auto-expiry)
Access Control
Role-based (admin/user), group-based resource access, nftables enforcement
Cryptography
WireGuard (Curve25519, ChaCha20-Poly1305, BLAKE2s)
Error Handling & Logging
Full audit trail, structured logging, no sensitive data in errors
Data Protection
Private keys never leave the device, no plaintext secrets at rest
Communications
All data-plane traffic encrypted end-to-end via WireGuard tunnels
We are working towards full Level 2 compliance. Areas currently under improvement include formal penetration testing by an external auditor and automated DAST integration in our CI pipeline. If you're an MSP evaluating our security posture, contact us for a detailed compliance matrix.
End-to-end encrypted data plane with minimal metadata
Stored in the control plane
Never stored or accessible
| Layer | Algorithm | Purpose |
|---|---|---|
| Key exchange | Curve25519 (ECDH) | Peer authentication and shared secret derivation |
| Symmetric encryption | ChaCha20-Poly1305 | Tunnel payload encryption + authentication |
| Hashing | BLAKE2s | Key derivation and MAC within Noise protocol |
| Session rotation | Pre-shared Key (PSK) | Ephemeral per-session PSK, rotated on TTL expiry |
| Password storage | bcrypt (cost 12) | User password hashing at rest |
WireGuard's Noise protocol framework (IKpsk2 pattern) provides forward secrecy, identity hiding, and resistance to key-compromise impersonation. The broker never holds private keys — it only routes encrypted WireGuard packets between peers using kernel-level nftables and policy routing.
We're happy to discuss our architecture in depth with prospective partners. Request a detailed security assessment or schedule a technical review call.