Privacy information — Nexus Atlas.NET Traversal

1. Controller

The controller for personal data collected through this website is “Nexus Atlas” Ltd, a single-member limited liability company registered in the Republic of Bulgaria — Commercial Register UIC (tax ID) 208756891 — reachable at office@nexusatlas.io.

2. Information we collect

What you type into a form: name, work email, company, and the inquiry, deployment or region description you choose to give.
Security and technical records needed to protect the website and diagnose failures: timestamps, request metadata, and abuse signals.
Nothing else rides along: the forms carry a honeypot field instead of a tracking script, there is no marketing list, and reading this site sends no data to third parties. Hosted traversal relays never collect decrypted application payloads — that boundary is described on the security page.

3. Purposes and legal basis

We process inquiries in order to answer them, assess pilot or customer fit, and prepare the services you ask about — as steps taken at your request prior to a contract (GDPR Art. 6(1)(b)) and on our legitimate interest in responding (Art. 6(1)(f)). Security and abuse records rest on our legitimate interest in keeping the site working (Art. 6(1)(f)). Where a service moves under contract, processing rests on that contract.

Please keep sensitive or classified operational details out of public web forms — the forms say the same.

5. Retention and security

Inquiry correspondence is kept as long as the conversation and any engagement that follows require — as a rule no longer than 24 months after the last exchange, unless a contract or a legal obligation keeps it. Security and abuse records are kept up to 12 months. Access controls, authentication, encryption in transit and deletion procedures are proportionate to the information held; no website can promise absolute security.

6. Hosted network data

The hosted relays and exits, and the control plane at nexusatlas.net that publishes them, keep operational records about the Atlas nodes that connect to them — not about what those nodes send. This is what is kept, and for how long.

Relay sessions. For each session it holds, a relay reports the node’s outer address and port as the relay sees them, how long the session has been up, and the bytes carried each way. The session is named by a salted hash: the relay draws the salt when it starts and never reports it, so the control plane cannot map a hash back to a node key, and a relay restart starts new hashes. Session history is deleted automatically seven days after a session was last seen. Connect and disconnect events, which carry the same hash and the address a session connected from, are deleted after 90 days.
Relay heartbeats. Each relay reports its session count, forwarded traffic and error counters every 30 seconds, and its host reports processor, memory and network load. The metrics derived from them are deleted after 30 days; each relay’s latest report is kept until the next one replaces it.
Speed tests. A speed test run against a relay is recorded with its source address and port, the approximate location derived from that address, the name the client gives itself, and the result. These records are kept until removed.
Presence records. A presence record is a sealed blob the server cannot open, filed under an id only the two nodes concerned can compute. It expires within ten minutes, is never served after that, and is then deleted automatically. The posting node’s key is checked on arrival and not stored; the record keeps only a keyed hash of it, so that no other node can overwrite the record. Request addresses are used for rate limiting in memory and are not stored with the record.
Hosted exits. An exit decrypts the traffic it carries to the internet, so it sees what any internet gateway sees — destination addresses, timing and volume, and the contents of anything not protected by its own encryption, such as TLS. It keeps no per-flow log: the destinations, names looked up and volumes of the traffic it carries are not recorded. It reports to the control plane only its own totals — sessions, bytes carried and load.
Host system logs. Each relay host’s system log records, per session, the connecting node’s public key and the outer address and port it connected from; each exit’s records the outer address and port of each device that connects and the tunnel address it is given. These logs stay on the host, are not sent to the control plane, and are kept until they are rotated out; no fixed period is set.
What is not kept. The control plane holds no list of which node is on which relay, and no relay records payload: relays forward sealed frames they cannot open.

These records are visible to authorized Nexus Atlas operators. A customer’s console shows that customer’s own nodes, from the reports those nodes send; it does not read the relays’ session records. The control plane runs on Google Cloud in the EU; the relays and exits run on servers rented from HostHatch in Los Angeles, New York, Zurich, Hong Kong and Sydney, and a node’s address reaches whichever of them it connects to.

We keep these records on our legitimate interest in operating, securing and measuring the hosted network (GDPR Art. 6(1)(f)). Where a service runs under contract, processing rests on that contract.

7. Your rights

You may request information, access, correction, erasure, restriction, portability, or object to processing based on legitimate interest; where processing rests on consent, you may withdraw it. Requests may require identity verification.

You may also lodge a complaint with the Bulgarian supervisory authority — the Commission for Personal Data Protection, cpdp.bg — or with the authority in your own country of residence.

8. Contact and changes

Privacy questions and rights requests go to office@nexusatlas.io. Material changes to this notice are reflected by an updated effective date on this page.

For general EU data-protection information, see the European Commission’s information for individuals.

Privacy notice