How Valenius protects your VPN fleet — the design decisions, the cryptography, and the operational practices behind them. Written to answer the questions your security team will ask before your first rollout.
Most of the security story is not a feature you switch on — it’s what the platform deliberately does not do.
Valenius uses the official upstream WireGuard® protocol exactly as published — no forks, no custom cryptography, no protocol changes. You get the security of the audited original and full compatibility with standard tooling.
VPN keys, configs, device data, and audit logs live on your servers. There is no mandatory vendor cloud, no phone-home, and no third party that could leak what it never receives.
The Community edition is published under AGPLv3. Your security team — or anyone else — can verify exactly what the software does instead of trusting a datasheet.
From the file permissions on a laptop to the management plane between your backend and your WireGuard® servers.
Every VPN profile is encrypted on the device, in both editions: DPAPI on Windows, AES-256-GCM on Linux, the platform keystore on macOS, Android, and iOS — whether pushed by an admin or uploaded by the user.
Backend and WireGuard® servers authenticate each other via an internal ECDSA P-256 certificate authority. Management calls are pinned to the backend’s identity — a certificate that is merely signed by the CA is not enough.
VPN sessions are authorized by CA-signed grants with an absolute expiry, enforced on the VPN server’s own clock. If the MFA component is unreachable or out of date, gated peers stay blocked — never silently allowed through.
OIDC/SSO against your identity provider plus TOTP two-factor — with login rate limiting and TOTP replay protection built in, in the free edition too.
Every update is SHA-256-verified before a single byte is installed, and Windows installers are code-signed via Azure Trusted Signing. Updates come from your backend, not a vendor server.
One-click backups are AES-256-GCM encrypted. Restores deliberately never re-import password hashes or TOTP secrets, so a backup file can’t become a credential store.
Every admin action and every security-relevant automatic event is logged with actor, target, and timestamp — and the log itself stores no passwords, keys, or config contents.
End users never hold admin rights. A privileged system service owns the tunnel; configs carry system-only file permissions; the local IPC channel verifies the calling user’s identity at the OS level.
The client API key can be rotated fleet-wide from the panel without reinstalling anything. Diagnostic log bundles are redacted on the device itself — API keys, VPN keys, and secrets never leave it.
Controls decay without process. These are ours.
The codebase undergoes recurring, structured security reviews across backend, server components, and all clients. Findings are tracked, prioritized by severity, and fixes are verified — not just closed.
Where a security control and availability conflict, Valenius blocks rather than guesses: gated peers stay gated when the MFA component is down, and updates that can’t be verified don’t install.
Found a vulnerability? Report it to helpdesk@stranto.com. We confirm receipt, keep you informed while we fix it, and credit you if you wish.
Send us your security questionnaire, or read the technical deep dive — the architecture is public and so is the code.
