Network Policy

// 01 — AUTONOMOUS SYSTEM

network    our own ASN · our own IP space
IRR / RIR  registry object published
upstream   redundant transit · BGP failover
edge       fiber where available · cellular bonding · satellite backup

// 02 — TRAFFIC HANDLING

• · No deep packet inspection (DPI) on customer traffic.
• · No throttling by protocol, destination, or content.
• · No injection of ads, trackers, or content.
• · DDoS mitigation at the IP / port level only — not content.
• · RTBH (remote-triggered black-hole) on operator request.

// 03 — LOGGING POSTURE

WE DO NOT LOG:

• · Customer traffic content / payload
• · DNS queries originating from customer VPS
• · Destination IPs of customer-initiated connections
• · NetFlow / sFlow records for customer traffic

WE DO RETAIN:

• · Aggregate bandwidth (per-port, not per-customer) · 90 days
• · BGP route + peering state (operational)
• · DDoS event log (source IPs of attacks)
• · Admin auth (SSH, API) · 30 days

// 04 — ENCRYPTION

• · Management plane: SSH, TLS 1.3
• · At rest: LUKS / dm-crypt
• · Inter-site tunnels: WireGuard / IPsec
• · We do not hold or escrow customer keys.