Modern authenticated encryption
WireGuard encrypts and authenticates every packet with ChaCha20Poly1305, using Curve25519 for key exchange — the same primitives used across modern VPN and messaging protocols.
Security
WireGuard encryption. Private by architecture.
Tejnet is built on WireGuard, with authenticated users, authorized devices and private paths. Customer application traffic is not the product; limited service metadata is still required to operate the network.
Encryption
Every path is a WireGuard tunnel.
Whether traffic takes a direct peer path or crosses managed relay, it stays inside the same authenticated, encrypted WireGuard session end to end.
Per-device keys
Each enrolled device gets its own WireGuard key pair tied to the account. A compromised or removed device can be revoked without affecting others.
Relay sees ciphertext only
Managed relay infrastructure forwards encrypted WireGuard packets between endpoints. It does not hold session keys, so it cannot read private application traffic.
Access control
Identity and enrollment come before connectivity.
Identity before access
User authentication and account authorization occur before a device is enrolled or a private resource is exposed.
Private service exposure
The product direction allows private targets to stay off the public internet rather than being published and firewalled.
Direct path first
Encrypted peer connectivity is preferred where network conditions permit it, with managed relay as fallback.
Data boundary
Customer traffic and service metadata are different things.
Private application payload
The architecture is intended to move private traffic between authorized endpoints rather than inspect customer application content.
What the service needs
Account identity, membership, device state, routing information and operational/security events are required for authentication, coordination, reliability and support.
Route approval controls for LAN and exit routing are in active development and will be documented here as they reach general availability. Tejnet will continue to document the security model precisely as remote access, policy and Security Console capabilities mature.