Built to the procurement bar.

Memory-safe core, written in Rust.

The data plane is implemented in Rust — the direction recommended by the US Office of the National Cyber Director (February 2024) and the NSA for security-critical software. Entire vulnerability classes that have plagued VPN implementations in C and C++ — buffer overflows, use-after-free, data races — are excluded by construction. Automated tests run across the workspace on every change, including end-to-end failover and key-rotation tests against two live daemons.

Named, not gestured at.

Noise IK handshake · X25519 key agreement · ChaCha20-Poly1305 authenticated encryption · BLAKE2s — the cryptographic family of WireGuard and Signal. Key rotation every 2 minutes or 1 GiB with measured zero loss during the swap; replay protection; private keys zeroised in memory; endpoint changes accepted only from cryptographically verified traffic. Each node is a signed record that names its keys, so a key is replaced without the node changing identity. Across the fleet, keys and the shared secret rotate on a schedule — accepted first, then used, the old kept until every node that matters has moved. A new node gets in only by a way the operator chose — a one-time pairing code, a fleet certificate, its key plus a second secret, or an operator’s approval — and every admission is recorded with who made it. Every standard the platform implements, follows or deliberately departs from is listed with its relationship on the standards page — nexusatlas.io.

Hop honesty.

Direct peer traffic is end-to-end encrypted. Mesh relay nodes re-encrypt per hop and are trusted, authenticated members of your own fleet. Only nodes whose record allows relaying ever carry traffic for others. Hosted Traversal relays forward opaque envelopes they cannot open — they hold no key that decrypts customer traffic. Three boundaries, three plain statements.

In a fleet of signed node records, every route is signed by the node that announced it, and a node removed from the fleet is refused by every node and every hosted relay at once.

Verifiable artifacts on every release.

Every release ships a CycloneDX software bill of materials; binaries embed their own dependency manifest (cargo-auditable) so an auditor can interrogate the artifact itself; releases are signed (Sigstore/cosign) and carry SLSA Level 3 build provenance — verifiable proof an artifact came from a specific commit on a specific build run. An auditor verification recipe is part of the documentation. Supports procurement checklists driven by the EU Cyber Resilience Act, NIS2, US EO 14028 and NDAA supply-chain requirements — support, not a compliance declaration.

Hardened by default.

The daemon runs as an unprivileged user with two capabilities (CAP_NET_ADMIN, and CAP_NET_BIND_SERVICE for the mesh DNS resolver’s port 53) inside a layered confinement stack: a hardened systemd unit (read-only filesystem, kernel protections, a seccomp system-call filter, no-new-privileges), a SELinux module on the RHEL family, an AppArmor profile on the Debian family — and an Ansible role that can chain in front of an OS security baseline (STIG), so one playbook lands a defensible posture.

One policy, one address, every domain.

A vulnerability in the software, the hosted services or any Nexus Atlas website is reported under a single coordinated-disclosure policy. Every host serves the same contact at the standard /.well-known/security.txt location (RFC 9116) — this one included — so a researcher who starts on nexusatlas.eu reaches the same policy as one who starts anywhere else.

It is a disclosure policy, not a bounty programme: no payment, no public credit, no naming of reporters. Reports are read and answered by an engineer.

The inner layer, by construction.

Atlas is positioned as the inner layer of a two-layer architecture in the style of the NSA’s Commercial Solutions for Classified programme, beneath a FIPS-validated IPsec or MACsec outer layer. Such architectures require different cipher families, different vendors and different codebases between the two layers — Atlas’s Noise / X25519 / ChaCha20 suite provides that diversity by design rather than as a gap to close.

Positioning, not a listing: Nexus Atlas is not CSfC-listed and does not claim to be. The claim is architectural fit, stated for the architects who design such systems.