Security

Encryption

All traffic between your devices travels in encrypted tunnels, protected with modern, well-reviewed cryptography. Each device creates its own private key, and that key never leaves the device: CloudVPN only ever holds the public half.

Only what you allow

A device reaches another only when a rule allows it, whether they connect directly or through the hub. You choose the rules: every device, servers only, or single services, one way or both ways. Each device enforces them on its CloudVPN connection, ahead of its own firewall, and blocks everything else there. Each device also has its own certificate, so a removed or disabled device is cut off within seconds.

What CloudVPN can and cannot see

• On a direct connection, traffic is encrypted from one of your devices to the other. CloudVPN does not see it.
• When traffic goes through a CloudVPN hub, the hub opens each packet's outer layer to forward it to the right device, as any VPN server does. It forwards only what your rules allow, and keeps no copy. If that matters for a service, use its own encryption too (HTTPS, encrypted SQL connections), or run the hub on your own server.
• CloudVPN records how devices connect: their names, addresses, the path each pair uses and how much traffic passes through the hub, so that the dashboard can show it and bill for it. It does not record what you send.

Your account

• Passwords are stored only as slow, salted hashes (argon2id).
• Sign-in codes from an authenticator app protect accounts, and are required for CloudVPN's own staff.
• Every change to your organisation is written to an audit log you can read.
• Each organisation's data is kept apart in the database, checked on every query.

Reporting a security problem

If you think you have found a vulnerability, email security@cloudvpn.co.ke. Please give us a chance to fix it before telling anyone else.