Documentation (security) — ZeroTier

Cited by

Facts read from this source

• End to end encryption Report an error

  “Traffic between devices is encrypted and authenticated end to end.”

• Identity curve25519 Report an error

  “Each device has a Curve25519 identity whose private key never leaves the device.”

• Ciphers Report an error

  “Peers use those identities to agree on symmetric keys, then protect packets with Salsa20/12-Poly1305, or AES-GMAC-SIV when both peers run ZeroTier One 1.6 or later.”

• No forward secrecy Report an error

  “ZeroTier does not currently provide forward secrecy.”

• Root relay metadata Report an error

  “Roots cannot decrypt or modify relayed traffic, but they do see routing metadata such as ZeroTier addresses, physical IP addresses, and timing.”

• Client source on github Report an error

  “Our client agent source code is available on GitHub.”

• Signed packages Report an error

  “Use ZeroTier via signed binary packages or the command-line installer.”

• SSO MFA rbac Report an error

  “All production system access is authenticated and authorized using single sign-on (SSO), multi-factor authentication (MFA), and role-based access control (RBAC).”

• Automated testing code review Report an error

  “We use automated testing and mandatory code review.”

• Dependency vulnerability scans Report an error

  “We track and address security issues in third-party dependencies using automated scans and vulnerability reporting.”

• Security reports email Report an error

  “Report vulnerabilities directly to security@zerotier.com.”

• Cve publication Report an error

  “We publish vulnerabilities in ZeroTier software with a Common Vulnerabilities and Exposures (CVE) identifier where applicable.”

• Employee background checks Report an error

  “All ZeroTier employees are subject to a formal background check and confidentiality/non-disclosure agreement. We require annual security training for our entire staff.”

• SOC 2 type2 Report an error

  “ZeroTier has completed a SOC 2 Type II examination of the controls protecting customer data and service reliability in our hosted services.”

• Signup no registration Report an error

  “Connecting to and using ZeroTier networks does not require account registration or any other personal information, and users can sign up for our hosted network administration service using only an email address.”

• Minimal collection Report an error

  “We collect and log only the data needed to provide our services, such as the IP addresses of network members and usage logs for administrative access. No additional data or telemetry leaves a device without an explicit opt-in choice, and all collected telemetry is anonymized.”

• Trail of bits audit Report an error

  “In March 2020, Trail of Bits reviewed ZeroTier's protocol and cryptographic design, including the AES-GMAC-SIV construction now used in ZeroTier One 1.6 and later.”

• Trust center Report an error

  “For details on our compliance program and security practices, and to request our SOC 2 report, visit our Trust Center.”

1 fact read from this page is not shown because it could not be confirmed on the page as captured.

Scores citing this record

• The DevOps Engineer Access model & connectivity
• The DevOps Engineer Logs, audit trail & incident response
• The DevOps Engineer Architecture, reliability & security assurance
• The IT Lead Logs, audit trail & incident response
• The IT Lead Architecture, reliability & security assurance
• The MSP Technician Access model & connectivity
• The MSP Technician Identity, access policy & device posture
• The MSP Technician Architecture, reliability & security assurance
• The Operations Manager Access model & connectivity
• The Operations Manager Logs, audit trail & incident response
• The Operations Manager Architecture, reliability & security assurance
• The Information Security Officer Access model & connectivity
• The Information Security Officer Identity, access policy & device posture
• The Information Security Officer Logs, audit trail & incident response
• The Information Security Officer Architecture, reliability & security assurance
• The Skeptic Access model & connectivity
• The Skeptic Identity, access policy & device posture
• The Skeptic Logs, audit trail & incident response
• The Skeptic Architecture, reliability & security assurance