Skip to main content

ZeroTier Security

Millions of users across thousands of organizations use ZeroTier for secure, private networking. Our platform keeps data confidential, minimizes data collection, and preserves user privacy.

How We Protect Our Users​

ZeroTier networks are secure by default. We use strong, modern cryptography and minimize data collection about users, networks, and devices.

Our Product​

Traffic between devices is encrypted and authenticated end to end. Each device has a Curve25519 identity whose private key never leaves the device. Peers use those identities to agree on symmetric keys, then protect packets with Salsa20/12-Poly1305, or AES-GMAC-SIV when both peers run ZeroTier One 1.6 or later. ZeroTier does not currently provide forward secrecy. Read our cryptography details

We collect minimal metadata about active networks and devices. ZeroTier tries to route traffic directly between peers. When a direct path isn't available, our root servers relay the encrypted packets. Roots cannot decrypt or modify relayed traffic, but they do see routing metadata such as ZeroTier addresses, physical IP addresses, and timing.

Your network controller, ZeroTier Central, is a trusted party. It decides which devices can join a network and pushes the rules, routes, and DNS settings members receive. Rules can copy or redirect traffic, so protect controller and Central access accordingly. See Controller Security Considerations, public networks, and API tokens.

Our client agent source code is available on GitHub. Use ZeroTier via signed binary packages or the command-line installer. The protocol and its cryptography are the same either way.

Platform Security​

ZeroTier’s production applications are deployed to a managed cloud environment, using best practices for testing, deployment, and administration. This includes automated build + test processes, continuous monitoring of our infrastructure, and the use of network segmentation to keep sensitive systems from being reachable from untrusted hosts.

All production system access is authenticated and authorized using single sign-on (SSO), multi-factor authentication (MFA), and role-based access control (RBAC). Critical services are restricted to private networks, using native cloud provider controls and secure remote access services.

Development Process​

We use automated testing and mandatory code review. We sign our packages so you can verify that binaries were published by ZeroTier and have not been tampered with.

We track and address security issues in third-party dependencies using automated scans and vulnerability reporting.

Incident Response​

We take security reports seriously. Report vulnerabilities directly to [email protected].

We publish vulnerabilities in ZeroTier software with a Common Vulnerabilities and Exposures (CVE) identifier where applicable. We provide potentially-impacted customers time to assess and mitigate issues in their own deployments before publicly sharing details of any vulnerability.

Business Practices​

All ZeroTier employees are subject to a formal background check and confidentiality/non-disclosure agreement. We require annual security training for our entire staff.

ZeroTier reviews all vendors’ security policies and disclosures to ensure they meet our own requirements and commitments to our users.

SOC 2 Compliance​

ZeroTier has completed a SOC 2 Type II examination of the controls protecting customer data and service reliability in our hosted services.

For details on our compliance program and security practices, and to request our SOC 2 report, visit our Trust Center.

Service Level Agreement​

For information about our service commitments, uptime guarantees, and support response times, see our Service Level Agreement (SLA).

Privacy​

Maintaining our users’ privacy is core to what we do and how we work at ZeroTier. Connecting to and using ZeroTier networks does not require account registration or any other personal information, and users can sign up for our hosted network administration service using only an email address.

We collect and log only the data needed to provide our services, such as the IP addresses of network members and usage logs for administrative access. No additional data or telemetry leaves a device without an explicit opt-in choice, and all collected telemetry is anonymized.

ZeroTier does not share any user information with 3rd parties except when it is strictly required or for our business operations (billing and support). We do not sell any customer information, analytics, or usage data.

See our full Privacy Policy for more details.

Audit​

In March 2020, Trail of Bits reviewed ZeroTier's protocol and cryptographic design, including the AES-GMAC-SIV construction now used in ZeroTier One 1.6 and later. Read the summary report.