Security
Learn about our security measures and commitment to protecting your data
Our Security Commitment
Nullsify doesn't run your VPN server — you do, on your own VPS. Our job is the software layer that installs, configures, and manages it for you. That architecture shapes our security posture: we minimize what we ever have access to in the first place, rather than promising to handle a lot of sensitive data carefully.
Nullsify's own platform (the dashboard, API, and database) runs on standard cloud hosting over encrypted connections. We don't own or operate the servers your VPN actually runs on — that's your VPS, entirely under your control and outside our infrastructure.
Never operates your traffic
Your VPN traffic flows straight between your device and your own VPS — nothing to log even if we wanted to.
SSH used once, then discarded
Your credential lives in memory only for the one-time agent install, and is never written to our database.
Per-server tokens, not shared secrets
Once installed, the agent authenticates with its own randomly generated token, issued to that server alone.
Encryption Standards
The actual encryption your traffic gets depends on the protocol you provision, since each uses its own modern cryptography rather than one blanket standard.
VLESS + Reality
X25519 key exchange, and disguises your connection as ordinary TLS to a real website.
WireGuard / AmneziaWG
Curve25519 for key exchange, ChaCha20-Poly1305 for encryption.
Dashboard & API
Served over HTTPS/TLS. The on-VPS agent authenticates with a per-server token, never a shared secret.
We Can't See Your VPN Traffic
Your VPN traffic flows directly between your device and your own VPS — it never touches Nullsify's infrastructure. We don't and can't see your browsing history, traffic destinations, DNS queries, or the IP addresses you connect to.
What we do store, to operate your account and dashboard: your account email, the servers you've added (name, IP address, protocol, status), who you've granted access to, and device labels you've given (e.g. "iPhone"). None of that is VPN traffic or browsing activity.
Supported Protocols
Nullsify provisions the following protocols on your own VPS:
V
VLESS
Runs with REALITY, disguising your traffic as ordinary HTTPS to a real website. Best where VPN protocols are actively detected and blocked.
A
AmneziaWG
WireGuard's speed with added obfuscation layered on top, making it harder for deep packet inspection to fingerprint as WireGuard.
W
WireGuard
The same fast core as AmneziaWG with obfuscation turned off, wire-compatible with any standard WireGuard client.
Your Server Credentials
What happens to the SSH credential you hand over when adding a VPS:
You provide SSH access, once
An SSH key or password, used over an encrypted connection purely to install a lightweight agent on your server.
The credential is discarded
It's never written to our database — it exists only in memory for that one-time setup, then it's gone.
The agent takes over
From then on your server is managed through the agent's own randomly generated token, not your SSH login. Every action — applying configs, adding or removing users and devices — goes through that channel.
You stay in control
Revoke our access anytime by deleting the server from your dashboard (which uninstalls the agent), or independently rotate the SSH key/password on your VPS yourself.
Found a vulnerability? Tell us.
We take all security reports seriously and follow responsible disclosure guidelines — we'll investigate and address issues promptly.
Contact Us