Security in a tunneling product is not a feature list — it is a question of how many things need to go wrong before unauthorized access is possible. ProxyPass is designed to require multiple simultaneous compromises.
Seven Layers of Security
Layer 1 — Encryption. Every connection — client to cloud, cloud to node — is encrypted with TLS. CONNECT mode traffic is end-to-end encrypted by the client, inside the already-encrypted tunnel. ProxyPass cannot inspect CONNECT traffic even technically.
Layer 2 — Authentication. Every request requires a valid API key. Keys are scoped to groups or individual nodes. A leaked group key can be mitigated by switching to individual node keys. A leaked node key affects only that one device.
Layer 3 — Identity. Node IDs are derived from the CPU hardware. Cloning a machine does not clone its identity. Stolen credentials are useless on different hardware.
Layer 4 — Access Control. Protected groups require one-time install keys for node registration. No device joins your fleet without your explicit authorization. Used keys cannot be reused.
Layer 5 — Incident Response. Node blocking terminates the tunnel immediately and quarantines the device to six-hour reconnect attempts. The effect is instant — no waiting for credential rotation or VPN reconfiguration.
Layer 6 — Visibility. Webhooks notify your systems when nodes connect, disconnect, register, or change settings. HMAC-SHA256 signatures verify every notification is authentic. The dashboard shows fleet status in real time.
Layer 7 — Jurisdiction. The infrastructure runs in Germany, operated by an Austrian company. EU law exclusively. No traffic logging. No request inspection. No data accessible to non-EU authorities without EU judicial process.
Scenario: The Attempted Breach
An attacker obtains an API key from a decommissioned device. They try to access your infrastructure:
- Layer 2 blocks them — the API key is valid, but...
- Layer 3 blocks them — the attacker's hardware produces a different CPU ID than the original node. The identity does not match.
- Layer 4 blocks them — the group is protected. The attacker cannot register a new node without a one-time install key.
Even with a valid API key, the attacker is stopped by hardware identity and access control. Meanwhile, your team notices the failed registration attempt in the dashboard, blocks the compromised key, and the original node's credentials are rotated.
Three layers engaged. Breach prevented. Total time: minutes.
The Bottom Line
No single layer is the security story. The story is that an attacker would need to break TLS encryption, obtain a valid API key, replicate the target CPU's hardware identity, bypass protected group registration, and do all of this before you notice and block the node. That is a high bar.
Security is not about making attacks impossible. It is about making them impractical. ProxyPass stacks enough layers that the effort required to breach a tunnel far exceeds the value of what is on the other side.