Security
Your VPN runs on your server, so your traffic, keys, and users stay there
Your traffic stays on your server
WarpSpeed runs WireGuard on a Linux server you own. Devices connect straight to that server, and no VPN traffic passes through WarpSpeed.
If warpspeedvpn.net cannot be reached, tunnels that are up keep running. A lapsed license does not stop a running VPN either. A server that restarts needs a valid license to start the VPN, and each license lasts until two days after its renewal date.
While warpspeedvpn.net is unreachable, sign-in with Google or GitHub, relayed mail, and updates wait until it is back.
Unmodified WireGuard
Your server runs the WireGuard built into the Linux kernel, set up with the WireGuard project's own libraries. Devices connect with the official open-source WireGuard apps.
Nothing in the tunnel is forked or proprietary. Your traffic runs through the same code the WireGuard project publishes.
Keys never leave your server
The server generates every WireGuard key itself: its own and each device's. Device keys stay on the server so users can download their configuration or scan a QR code, and they are never sent to WarpSpeed.
Administrators can give every device new keys at once under Settings, Reset.
What warpspeedvpn.net stores
- Your account. Your email address, name, and billing address, the address and browser you signed up from, and the Google or GitHub account you sign in with, if any.
- Billing. Invoices and payments. Stripe holds card numbers, and we never see them.
- Each server. Its name, version, plan, and license, the address it checks in from, its CPU, memory, and uptime, and how many users and devices it has. It reports only the counts, not names or email addresses.
- Machine secrets. The secrets a server uses to talk to warpspeedvpn.net, and its claim codes, are stored only as hashes.
- Relayed mail. A server without its own mail server sends its invites and sign-in codes through warpspeedvpn.net. Message bodies are deleted after 30 days. A server with its own mail server sends nothing through us.
warpspeedvpn.net never holds WireGuard keys, device configurations, your server's list of users, or traffic.
Encryption
- Tunnels. WireGuard, with Curve25519, ChaCha20-Poly1305, and BLAKE2s.
- Your console. HTTPS with TLS 1.2 or later and a Let's Encrypt certificate the server gets and renews itself.
- warpspeedvpn.net. TLS 1.2 or later with authenticated encryption ciphers only, and HTTP Strict Transport Security.
- Licenses. Signed with RSA, and checked by your server before it uses them.
Sign-in
- Invite only. Only users an administrator adds can sign in to a console, matched by their email address.
- Passwords and codes. Passwords are stored with bcrypt. Emailed sign-in codes work once, expire after 10 minutes, and lock after five wrong tries.
- Google and GitHub. Off until an administrator turns it on. Sign-in goes through warpspeedvpn.net with PKCE, which passes on the verified address and keeps nothing about your users.
- SAML single sign-on. Connect your own identity provider on Team and Business.
- Sessions. HttpOnly, SameSite, and Secure cookies, with a new session at every sign-in. Forms only accept requests from their own site.
Updates
Every download is checked against its published checksum before it is installed. By default updates install overnight, in a window you can change.
The server tests that the new version starts and opens its data before keeping it, and rolls back on its own if it does not. Administrators can switch to notify only or manual under Settings, Updates.
Data on your server
Everything the server keeps lives in its data directory, /warpspeed by default, readable only by root. A copy of the database is kept before every update.
Write a backup or export users, devices, and settings at any time. Exports leave out keys and passwords.
sudo warpspeed backup --output /root/warpspeed-backup.sqlite
Subprocessors
| Service | Used for |
|---|---|
| Stripe | Payments and card storage |
| Google Workspace | Support mail and the mail we send |
| Google and GitHub | Optional sign-in |
| DigitalOcean | Hosting for warpspeedvpn.net, and DNS |
| Let's Encrypt | Certificates |
| Google Analytics and Google Ads | Visits to our marketing pages only |
Compliance
WarpSpeed is software you run on your own server, and we never hold your VPN traffic, keys, or users. For a security questionnaire, email support@warpspeedvpn.com and we fill it in.
Report a vulnerability
Email support@warpspeedvpn.com with the details and how to reproduce it. The same address is in our security.txt.