Traffic in transit
Traffic between our sites travels over links we operate or lease exclusively. Management and control traffic is encrypted with TLS 1.3 or IPsec on every hop, and customer sessions keep whatever encryption they arrived with.
We do not inspect payloads. Routing decisions use only what a router needs: addresses, ports, and the latency and loss we measure ourselves.
What we keep
To run the network we store aggregated flow metadata: volumes per route, latency and loss. It is kept for 14 days, then deleted. Aggregates older than that contain no addresses.
- No payload capture, at any site.
- No sale or sharing of traffic data with third parties.
- Metadata is stored in the European Union.
Access to the network
Network equipment can be reached only from our management network, through hardware security keys bound to named engineers. Every configuration change is reviewed by a second engineer and recorded.
Access is reviewed every quarter and removed the same day someone changes role.
Attack mitigation
Volumetric attacks are filtered at the edge site where they enter, so they never share a path with clean traffic. Filtering rules are generated from traffic baselines for each customer and are reviewed by an engineer during any sustained event.
Reporting a vulnerability
If you find a security issue in our network or this website, email security@tnffx.com with the steps to reproduce it. We reply within two working days and will keep you updated until it is fixed.
Please give us reasonable time to fix the issue before you publish it, and do not access data that isn't yours while testing.