Security - IX Bond

Encryption

Built on WireGuard's modern, audited cryptographic stack

IX Bond leverages WireGuard's carefully chosen cryptographic primitives. Unlike legacy VPN protocols that offer dozens of cipher combinations (many of which are insecure), WireGuard uses a single, opinionated set of state-of-the-art algorithms. This eliminates cipher negotiation attacks and dramatically reduces the attack surface.

Data Encryption

Symmetric encryption for all tunnel traffic

ChaCha20-Poly1305

Key Exchange

Elliptic curve Diffie-Hellman

Curve25519 (ECDH)

Hashing

Cryptographic hash function

BLAKE2s

Hashtable Keys

Keyed hash for internal tables

SipHash24

All four primitives are modern, fast, and resistant to known attacks. ChaCha20-Poly1305 provides authenticated encryption that is immune to timing attacks and outperforms AES on devices without hardware acceleration. Curve25519 provides 128-bit security with compact 32-byte keys.

Key Management

Automated key lifecycle with zero human intervention required

Encrypted at Rest

All private keys stored on disk are encrypted with AES-256-GCM. The encryption key is derived from hardware-bound secrets where available (TPM 2.0, Secure Enclave).

Trust on First Use (TOFU)

Node identity is established on first registration and pinned to the control server. Any key change triggers an alert and requires administrator approval.

Automatic 30-Day Rotation

WireGuard key pairs are automatically rotated every 30 days. Rotation is seamless with zero downtime — new keys are distributed and activated before the old keys expire.

Instant Revocation

Compromised keys can be revoked instantly through the control server. All peers remove the revoked key within seconds, and the node must re-authenticate to rejoin the mesh.

Zero Trust Architecture

Every connection is verified. No implicit trust, ever.

IX Bond implements a genuine Zero Trust Network Access (ZTNA) model where trust is never assumed based on network location. Every connection between any two nodes requires cryptographic authentication, authorization against the current policy, and continuous verification throughout the session.

Per-Connection Authentication

Every new connection requires a valid WireGuard handshake using the node's current key pair. There are no session tokens to steal or replay.

Tag-Based ACLs

Access policies are defined using tags, not IP addresses. Tags are assigned to nodes and users, and ACL rules specify which tags can communicate. This decouples policy from network topology.

Device Posture Enforcement

Nodes can be required to meet posture requirements before joining the mesh: OS version, disk encryption status, firewall enabled, antivirus running, and custom checks.

Continuous Verification

Device posture is checked continuously, not just at connection time. Nodes that fall out of compliance are automatically quarantined until posture is restored.

Infrastructure Security

Cloud-managed means your data is protected by enterprise-grade encryption, access controls, and SOC 2 compliant infrastructure

One of the most impactful security decision in IX Bond's architecture is the cloud-managed deployment model. When you use a SaaS VPN provider, your encryption keys, network topology, access policies, and metadata all live on their infrastructure. With IX Bond, everything stays on yours.

No third-party key custody: Your WireGuard private keys are generated on your machines and never transmitted anywhere. IX Bond Inc. cannot decrypt your traffic under any circumstances, even under legal compulsion, because we simply do not possess your keys.
No metadata exposure: Your connection logs, node inventory, and mesh topology are stored on your control server. We have no visibility into who connects to what, when, or from where.
Regulatory alignment: Self-hosting means your data stays within the jurisdictions you choose. Deploy the control server in the EU for GDPR, or in a specific AWS region for data sovereignty requirements.
Supply chain control: You control when and how updates are applied. There is no automatic forced update that could introduce vulnerabilities. You can audit every release before deploying it.

Network Security

Secure connectivity without exposing internal networks

NAT Traversal

IX Bond uses STUN, UDP hole punching, UPnP, and NAT-PMP to establish direct peer-to-peer connections through NAT devices without opening inbound ports or exposing internal networks.

Kill Switch

The kill switch prevents any traffic from leaking outside the WireGuard tunnel if the VPN connection drops unexpectedly. Configurable per-node with bypass rules for critical services.

Relay Fallback

When direct P2P connection is not possible (e.g., symmetric NAT), traffic is relayed through encrypted DERP servers that you self-host. Relayed traffic remains end-to-end encrypted.

DNS Filtering

Built-in DNS resolution with optional threat filtering. Block known malware domains, phishing sites, and C2 servers at the mesh level without additional software.

Certificate Management

Internal PKI with automatic issuance and rotation

IX Bond operates an internal Certificate Authority (CA) for securing communication between the control server and mesh nodes. This is separate from the WireGuard data plane encryption and provides an additional layer of authentication for the control plane.

Ed25519 Root CA: The internal CA uses Ed25519 for compact, fast, and secure certificate signing. The root key is generated during initial deployment and can be stored in a hardware security module (HSM) for production environments.
Automatic Per-Node Certificates: Each node receives a unique TLS certificate automatically upon registration. Certificates are used for mutual TLS (mTLS) authentication between nodes and the control server.
Short-Lived Certificates: Node certificates have a default validity of 24 hours and are automatically renewed. This limits the window of exposure if a certificate is compromised.
Certificate Revocation: Compromised certificates can be revoked immediately through the control server. Nodes check revocation status on every connection attempt.

Audit Logging

Complete visibility into every action across your mesh

IX Bond provides comprehensive audit logging that records every significant action within your mesh network. Logs are structured, searchable, and designed for integration with your existing SIEM and monitoring tools.

Comprehensive Coverage

Node registrations, key rotations, ACL changes, authentication attempts (successful and failed), administrative actions, and policy modifications are all logged with full context.

Webhook Notifications

Configure webhooks to receive real-time notifications for security-relevant events. Send alerts to Slack, PagerDuty, Opsgenie, or any HTTP endpoint.

Immutable Log

Audit logs are append-only with cryptographic chaining. Each log entry includes a hash of the previous entry, making tampering detectable. Export to immutable storage for compliance.

SIEM Integration

Export logs in JSON, CEF, or syslog format. Native integrations with Splunk, Elastic, Datadog, and any syslog-compatible collector.

Compliance

Meeting the standards that regulated industries require

In Progress

SOC 2 Type II

Independent audit of security, availability, and confidentiality controls. Expected completion Q3 2026.

Ready

GDPR

Cloud-managed model with DPA available. Data stays on your infrastructure in your chosen jurisdiction.

Compatible

HIPAA

Architecture supports HIPAA requirements. Business Associate Agreement (BAA) available for healthcare organizations.

Compliant

Export Control

Compliant with U.S. Export Administration Regulations (EAR). Uses publicly available encryption algorithms.

Vulnerability Management

Proactive security through testing, research, and responsible disclosure

Responsible Disclosure Policy

We welcome and appreciate security researchers who report vulnerabilities to us responsibly. If you discover a security issue in IX Bond, please report it to security@ixbond.com. We ask that you:

Provide sufficient detail to reproduce the vulnerability
Allow us reasonable time (90 days) to investigate and remediate before public disclosure
Do not access or modify other users' data
Do not perform denial-of-service attacks

We commit to acknowledging receipt within 24 hours, providing an initial assessment within 72 hours, and keeping you informed throughout the remediation process.

Bug Bounty Program

IX Bond maintains an invitation-only bug bounty program for experienced security researchers. The program covers the IX Bond control server, agent, API, and web dashboard. If you are interested in participating, please contact security@ixbond.com with your background and areas of expertise.

Penetration Testing

IX Bond undergoes annual third-party penetration testing conducted by an independent security firm. Tests cover the full stack: network layer, application layer, API security, authentication and authorization, cryptographic implementation, and privilege escalation. Remediation is tracked to completion, and re-testing confirms that all findings are resolved.

Security is foundational, not an afterthought