Security & trust

How Polfence is built and run.

The short version: everything runs in the European Union, under an EU company, on open cryptography, with the paperwork available in the dashboard. The long version is below.

Architecture and data residency

Polfence is operated by Polfence sp. z o.o., registered in Gdańsk, Poland. The control plane, database, relays, filtering resolvers and uptime probes run on Scaleway in France and the Netherlands. There is no US parent company, no US region and no transfer of personal data outside the EU/EEA.

Control plane: Scaleway, Paris (fr-par)
Nameservers: ns1 Paris · ns2 Amsterdam
Relays and probes: EU regions only
Database: Managed PostgreSQL, Paris, encrypted volumes
Legal entity: Polfence sp. z o.o., Gdańsk, Poland
Data transfers outside EU/EEA: None

Encryption

Tunnels

Secure Connect and ZTNA run on WireGuard: Noise protocol handshake, ChaCha20-Poly1305 for transport, Curve25519 key exchange. The Perimeter engine adds obfuscation on top without changing the cryptography.

In transit

Dashboard, API, DoH and the update endpoints are served over TLS 1.3 with certificates from Let's Encrypt. Polfence Connect sessions use WebRTC with DTLS-SRTP end to end.

At rest

Secrets that must be readable by the service (VPN private keys, imported router configs, SSO client secrets, webhook signing keys) are encrypted with AES-256-GCM under a key held outside the database. Passwords are bcrypt hashes. API keys and update tokens are stored as SHA-256 hashes.

Webhooks

Every webhook delivery is signed with HMAC-SHA256 over the raw body using a per-endpoint secret, so receivers can reject anything we did not send.

Identity and access

Two-factor authentication (TOTP) for every account, enforceable for the whole organisation from the security policy.
Enterprise SSO over OIDC with Microsoft Entra ID, Google Workspace and Okta; SCIM 2.0 provisioning and deprovisioning.
Desktop apps sign in through the browser with OAuth PKCE; no password ever enters a native client.
Device posture (disk encryption, firewall, screen lock, OS version) is evaluated before a device is admitted, and a device that stops reporting is removed at the WireGuard layer.
Just-in-time access grants are time-boxed and expire on their own.

Sub-processors

We keep the list short on purpose. Both sub-processors are established in the EU. Changes to this list are announced to organisation owners in advance.

Entity	Location	Purpose	Data
Scaleway SAS	Paris, France	Cloud hosting, managed database, transactional email	All service data
Revolut Bank UAB	Vilnius, Lithuania	Card payment processing for paid plans	Payment details; never stored by Polfence

Data retention

Account and configuration data: For the life of the account, deleted on account deletion
Audit trail: 365 days by default; set your own window in the organisation security policy. Exportable at any time.
Shield query logs: Configurable per profile, including off
Monitor check history: 90 days
Invoices: As required by Polish accounting law

Deleting an account removes hostnames from DNS immediately and erases personal data not subject to statutory retention.

GDPR, DPA and NIS2

A data processing agreement under Article 28 GDPR, with the sub-processor list above, is available in the dashboard for every organisation. You do not need to ask sales for it. The dashboard also contains an organisation security policy, a NIS2 Article 21 readiness assessment and a printable compliance report.

NIS2 & GDPR compliance Privacy policy

Vulnerability disclosure

If you believe you have found a security issue in Polfence, email security@polfence.com. Include steps to reproduce and, if relevant, the affected hostname or account id. We acknowledge reports within two working days, keep you informed while we fix the issue, and will credit you if you wish. Please do not run automated scanners against customer zones or attempt to access data that is not yours.

Status and incident history are published at polfence.com/status.