Built to the procurement bar.

Memory-safe core, written in Rust.

The data plane is implemented in Rust — the direction recommended by the US Office of the National Cyber Director (February 2024) and the NSA for security-critical software. Entire vulnerability classes that have plagued VPN implementations in C and C++ — buffer overflows, use-after-free, data races — are excluded by construction. Automated tests run across the workspace on every change, including end-to-end failover and key-rotation tests against two live daemons.

Named, not gestured at.

Noise IK handshake · X25519 key agreement · ChaCha20-Poly1305 authenticated encryption · BLAKE2s — the cryptographic family of WireGuard and Signal. Key rotation every 2 minutes or 1 GiB with measured zero loss during the swap; replay protection; private keys zeroised in memory; endpoint changes accepted only from cryptographically verified traffic.

Hop honesty.

Direct peer traffic is end-to-end encrypted. Mesh relay nodes re-encrypt per hop and are trusted, authenticated members of your own fleet. Hosted Traversal relays forward opaque envelopes they cannot open — they hold no key that decrypts customer traffic. Three boundaries, three plain statements.

Verifiable artifacts on every release.

Every release ships a CycloneDX software bill of materials; binaries embed their own dependency manifest (cargo-auditable) so an auditor can interrogate the artifact itself; releases are signed (Sigstore/cosign) and carry SLSA Level 3 build provenance — verifiable proof an artifact came from a specific commit on a specific build run. An auditor verification recipe is part of the documentation. Supports procurement checklists driven by the EU Cyber Resilience Act, NIS2, US EO 14028 and NDAA supply-chain requirements — support, not a compliance declaration.

Hardened by default.

The daemon runs as an unprivileged user with a single capability (CAP_NET_ADMIN) inside a layered confinement stack: a hardened systemd unit (read-only filesystem, kernel protections, a seccomp system-call filter, no-new-privileges), a SELinux module on the RHEL family, an AppArmor profile on the Debian family — and an Ansible role that can chain in front of an OS security baseline (STIG), so one playbook lands a defensible posture.

One policy, one address, every domain.

A vulnerability in the software, the hosted services or any Nexus Atlas website is reported under a single coordinated-disclosure policy. Every host serves the same contact at the standard /.well-known/security.txt location (RFC 9116) — this one included — so a researcher who starts on nexusatlas.eu reaches the same policy as one who starts anywhere else.

It is a disclosure policy, not a bounty programme: no payment, no public credit, no naming of reporters. Reports are read and answered by an engineer.

The inner layer, by construction.

Atlas is positioned as the inner layer of a two-layer architecture in the style of the NSA’s Commercial Solutions for Classified programme, beneath a FIPS-validated IPsec or MACsec outer layer. Such architectures require different cipher families, different vendors and different codebases between the two layers — Atlas’s Noise / X25519 / ChaCha20 suite provides that diversity by design rather than as a gap to close.

Positioning, not a listing: Nexus Atlas is not CSfC-listed and does not claim to be. The claim is architectural fit, stated for the architects who design such systems.