Mesh VPNs and private networks
Defguard privacy rating
Self-hosted WireGuard VPN platform with multi-factor authentication on every connection, identity management and access rules, from a company in Poland.
Summary
Defguard scores 82 out of 100 (grade B) on the mesh VPNs and private networks criteria. It meets 6 of 7 criteria: open source, no ads or data sales, independent audit, keys stay on devices, self-hosted coordination server and no connection logs by default. It does not meet no trackers or telemetry. It is based in Poland: Not in the Five, Nine or Fourteen Eyes; EU member (GDPR).
Score 82 out of 100. How scoring works
Criteria
-
Yes
Open source Weight 3 of 3 Source-available
Is all the source code needed to run the product public?
All code is public. The core is AGPL-3.0, and enterprise features in the same repository use the source-available Defguard Enterprise License.
-
No
No trackers or telemetry Weight 3 of 3
Are the website and apps free of third-party trackers, with any analytics anonymous and any telemetry off by default?
The website loads Google Tag Manager.
-
Yes
No ads or data sales Weight 2 of 3
Is the product funded without advertising, ad targeting or selling user data?
Funded by paid enterprise licenses, with no ads.
-
Yes
Independent audit Weight 2 of 3
Has an independent security or privacy audit been published within the last three years?
Findings from periodic penetration tests by ISEC are published in full, with links to the fixes.
-
Yes
Keys stay on devices Weight 3 of 3
Is traffic encrypted between devices with private keys created on each device, so the coordination server and relays cannot read it?
The server does not store WireGuard private keys. Traffic ends at gateways on your own infrastructure.
-
Yes
Self-hosted coordination server Weight 2 of 3
Can the coordination or control server be self-hosted with open-source software?
The core server is open source and self-hosted only.
-
Yes
No connection logs by default Weight 2 of 3
Are connection logs and client diagnostic logs kept off the vendor's servers unless a user or admin turns them on?
Defguard is self-hosted only, so connection logs stay on your own servers.