Security Overview
Data Relay Link separates Data Relay Link tunnel authentication from management-plane trust. Keeping those responsibilities separate is important when troubleshooting or reviewing risk.Security model at a glance
The Data Relay Link token is not an Enrollment Code, Bootstrap Ticket, or management API credential.Trust establishment
Enrollment and signed client management use verified HTTPS. There is no supported production plain-HTTP fallback.Data Relay Link tunnel plane
- Direct mode uses Data Relay Link native TLS for control.
- Enterprise single-443 carries Data Relay Link control over WSS.
- The Data Relay Link token authenticates the tunnel.
- Published service traffic is forwarded through Data Relay Link after the proxy is registered.
Persistent management identity
After enrollment, the client keeps a persistent ECDSA P-256 management identity. The private key stays on the client. Signed management requests bind request data to freshness/replay protections such as timestamp/nonce handling so stale or replayed requests can be rejected.Zero-Touch credential properties
A Bootstrap Ticket is designed to be:- high entropy
- short-lived
- first-machine bound
- single-use after successful enrollment
- hashed at rest on the server
- sensitive until used, expired, or revoked
Secrets to protect
Security boundaries
The product does not claim to protect secrets from a fully compromised root account on the server or client.Published stable access-control boundary
The current published stable release is v2.2.1. In that release, Data Relay Link does not provide a built-in per-service source-IP allowlist policy or an application-style RBAC layer for published TCP services. For v2.2.1, restrict who can reach a published service with the controls that own that boundary, such as the external firewall/security group, target-host ACLs, SSH keys/accounts, database ACLs, or the target application’s own authentication and authorization.The product
main / release-preparation tree contains later Access Control Pack work, but that must not be treated as part of the published stable contract until a release containing it is actually tagged and published.