Security / trust page — Defguard

Cited by

Facts read from this source

• ISO 27001 Report an error

  “We are ISO-27001:2023 certified.”

• Pentest report public Report an error

  “we are the only VPN solution that publishes detailed penetration testing reports from periodic security audits conducted by ISEC on all Defguard components”

• Sbom Report an error

  “We publish Software Bill of Materials (SBOM) for all our components, providing detailed information about the ingredients of the software we ship. Every day we use the SBOMs to scan for vulnerabilities in our dependencies and publish the results.”

• Vulnerability disclosure Report an error

  “We welcome responsible disclosure from the security community. If you've discovered a potential vulnerability in Defguard, please contact our security team at security@defguard.net using encrypted communication.”

• Bug bounty Report an error

  “Please note that we do not offer a bug bounty program, as Defguard is open-source software.”

• Pgp key Report an error

  “Encrypt your message using our PGP public key, available athttps://defguard.net/pgp-key.txt (fingerprint: 3CC9 D7FD A5F5 DE35 52D8 806E FA1F 797D FA71 B44A).”

• Datacenter Report an error

  “Our services are hosted in an ISO27001-certified data center we helped design (Technopark Pomerania).”

• On premise Report an error

  “We build with an "on-premise first" mindset and architecture so you can control everything!”

• No vendor lock in Report an error

  “No vendor lock-in — install on whatever hardware and operating system you like.”

• Architecture control plane Report an error

  “Our Control Plane (controlling other components and user/network data) can be deployed in the Intranet segment, not accessible from the Internet ever!”

• Public components Report an error

  “We have only two public components available from the Internet - when properly deployed and secured, they guarantee your network's safety!”

• Proxy design Report an error

  “Proxy is stateless and has no user/network data and no connection to any other components — the control plane connects to proxy (not the other way around), just collecting the data securely”

• Gateway design Report an error

  “Gateway only exposes the WireGuard® port — meaning in order to breach it, the Kernel would need to be vulnerable”

• Open source Report an error

  “Most of our code is open source, and the enterprise part is open code — enabling you to freely test and verify.”

• Language rust Report an error

  “We chose Rust”

• Docker signing Report an error

  “All official Docker images are signed using Cosign and automatically scanned for known vulnerabilities with Trivy.”

• Release checksums Report an error

  “All release assets (binaries, packages, etc.) include SHA256 checksums that are automatically generated and published with each GitHub release.”

• Internal self hosting Report an error

  “We communicate internally on secure on-premise Matrix (matrix.org) channels. We use only self-hosted runners on GitHub to build our releases.”

• Software stack Report an error

  “Debian debian.org Kubernetes with Rancher Rancher Knowledge management Outline Password storage Vaultwarden Firewall OPNsense Monitoring Uptime Kuma Backups Restic IdM/SSO Defguard”

• Isec supervision Report an error

  “Defguard's code and architecture is in constant review by Polish cybersecurity experts: ISEC.”

• Isec investor Report an error

  “ISEC became an investor, and we have an ongoing relationship for pentests, architecture supervision, and 0days and CVE insights of the security solutions landscape.”

• MFA yubikeys Report an error

  “We use Yubico YubiKeys for 2FA/MFA for everything, provisioned via Defguard.”

• Network security Report an error

  “Our network uses enterprise WiFi (via Defguard RADIUS & OpenLDAP) and VLAN segmentation with OPNSense + Defguard.”

• Physical security Report an error

  “Our office uses access cards for physical security control.”

• Entity Report an error

  “© 2026 defguard sp z o.o”

• Open process Report an error

  “Our whole process: Release cycle, Roadmap and Architecture Decision Records are openly managed and shared.”

Scores citing this record

• The DevOps Engineer Architecture, reliability & security assurance
• The DevOps Engineer European sovereignty
• The IT Lead Logs, audit trail & incident response
• The IT Lead Architecture, reliability & security assurance
• The IT Lead European sovereignty
• The MSP Technician Architecture, reliability & security assurance
• The MSP Technician European sovereignty
• The Operations Manager Architecture, reliability & security assurance
• The Operations Manager European sovereignty
• The Information Security Officer Access model & connectivity
• The Information Security Officer Architecture, reliability & security assurance
• The Information Security Officer European sovereignty
• The Skeptic Access model & connectivity
• The Skeptic Architecture, reliability & security assurance
• The Skeptic European sovereignty