Privacy by Design: What Building Syslok and OxidVPN Taught Us

Most security promises are policies: “we don’t keep logs”, “access is only used with permission”, “sessions are closed when the job is done”. Policies are only as strong as the people and processes behind them.

When we built Syslok, our remote-access tool, and OxidVPN, we set ourselves a harder rule: wherever possible, make the unsafe thing impossible, not just forbidden. Here is what that looks like in practice.

Remote access is a favourite attack path

Remote-access tools are incredibly useful for IT support and operations, and attackers know it. Once a remote-access agent is installed and left running, it becomes a permanent door into the machine. Many serious incidents start with a legitimate tool that was never removed.

Syslok: nothing installed, nothing left behind

Syslok starts from the assumption that an unused door should not exist.

• Zero footprint. One command loads the agent into memory. There is no installer, no service and nothing to uninstall. When the session ends, it is gone.
• Hard time limits. Every session has a fixed lifetime, enforced on the device. It cannot be quietly extended, only renewed with fresh consent.
• Provable consent. Unique session codes, explicit acceptance of the time limit and an immutable audit trail show that access was authorised.
• End-to-end encryption with new keys for every session.
• A full audit trail that streams to security tools such as Splunk, Microsoft Sentinel and Elastic.

The result is the reach of a hardware KVM switch without leaving a permanent agent on every machine.

OxidVPN: trust you can inspect

A VPN asks for enormous trust: it sees where all your traffic goes. “Trust us” is not a good enough answer, so OxidVPN is built on GhostWire, an open-source protocol anyone can audit, running on WireGuard for speed.

Other choices follow the same principle:

• Zero logs. No browsing activity, connection timestamps or IP addresses are kept, so there is nothing to hand over or leak.
• Kill switch. If the tunnel drops, traffic stops instead of silently going out unprotected.
• Multi-hop routing through servers in different jurisdictions.
• Traffic obfuscation that makes VPN traffic look like ordinary HTTPS to get past deep packet inspection.

Principles you can apply to any software

1. Don’t store what you don’t need. Data you never collect cannot leak.
2. Make access expire by default. Permanent credentials and agents are permanent risk.
3. Prefer verifiable over promised. Open protocols, audit logs and signed builds beat marketing claims.
4. Fail closed. When something breaks, block rather than leak.
5. Record consent. For any access to someone else’s device or data, keep proof that it was allowed.

These principles shape everything we build, from client platforms to our own products. Our DevOps Services and Software Development teams can apply them to your systems. Get in touch if security is keeping you up at night.