Security

01

Encryption and your key

Every backup EdgeOwl makes, the readable export and the binary file, is encrypted with age, an open-source tool built on X25519. age works with a key pair: a public half that can lock a file and a private half that can open it.

Your key pair is created in your browser when you sign up. The private half never leaves you: it is shown once as a recovery code and is never sent to our servers. We keep only the public half, so we can lock backups for you but have no way to open them.

The same rule applies to our own staff, to anyone who gets hold of our storage, and to any authority that asks. There is nothing on our side that decrypts a backup.

[TODO: engineering to confirm where in the pipeline the export is encrypted and the exact wording]

02

What we can and cannot see

To run the service we need some facts about each router: what model it is, which RouterOS version it runs, when the last backup happened and whether jobs succeed. That is operational metadata, and it is the list on the left of the table.

What we cannot see is everything inside the backup: interface names, addresses, firewall rules, VPN secrets, user accounts. We also cannot see your encryption key. The router password that the setup script creates for us is encrypted at rest in our database; the key lives only in the app's environment, not in the database. It is only ever decrypted inside our servers at the moment of a job.

Your account and billing details are the personal data we hold; the full list is in the Privacy Policy. Payments themselves go through Paddle, so card numbers never reach us.

03

Access to your router

EdgeOwl never asks for your admin password. The setup script you paste into the terminal creates edgeowl, a dedicated user with only the policies backups and updates need (read, write, rest-api, test, sensitive, ftp, reboot, ssh): no Winbox, no WebFig, no user management. It is reachable only from our addresses (egress.edgeowl.org) and every action is logged in your dashboard. Revoke it any time with /user remove edgeowl.

The router's own firewall does the limiting: it accepts REST and SSH only from the addresses behind egress.edgeowl.org, a name RouterOS resolves and keeps up to date by itself. A router behind NAT or CGNAT uses the Relay instead: it opens an outbound SSTP tunnel (RouterOS 7) to our Relay servers, so nothing is opened on the firewall and no port is forwarded.

Revoking access takes one command on the router: delete the user. EdgeOwl loses the connection immediately, and your backups stay available for download.

The exact script and policies are in the setup guide; this is a shortened example.

04

Safe updates

An update is the one job that can break a router, so it is the most conservative thing EdgeOwl does. Every update starts with a fresh backup. If the backup fails, the update does not run, full stop.

1. Backup: export and binary, encrypted and stored.
2. Check the channel: we install only the version RouterOS itself offers in the device's own channel, stable or long-term. We never jump major versions automatically.
3. Install and reboot.
4. Wait for the router, then run Check: it must answer, and the version must match.
5. If it does not come back, you get an alert with the pre-update backup ready to restore.

You watch every step live in the dashboard. Updates never start on their own: you press the button or they run on the weekly schedule you have approved, with a notification the day before. Updates run on RouterOS 7; RouterOS 6 coming soon. Until then we can help you move: migration to v7 is a separate assisted service.

05

Where data lives

Backups and the database stay in the EU: Amsterdam (Railway) and Frankfurt (Amazon S3). Payments go through Paddle (UK), DNS and proxy through Cloudflare's global network. Encrypted backups are stored in Amazon S3 (eu-central-1). Router passwords are encrypted at rest in our database; the key lives only in the app's environment, not in the database. Relay servers, which only pass traffic through, run at Hetzner in Germany.

EdgeOwl is operated by Support Rapid SRL in Chișinău, Republic of Moldova. Processing is covered by Moldovan Law 195/2024 on personal data and by the GDPR for customers in the EU. The sub-processors we rely on are listed on the right; the full list with the legal basis for each is in the Privacy Policy, and business customers can sign our Data Processing Agreement.

06

Restore without EdgeOwl

A backup you cannot open without us would not be yours. Every copy can be downloaded from the dashboard as the encrypted file, and decrypted on any computer with age and your key. No EdgeOwl account, server or goodwill is needed for that.

We also remind you, after the first backup and then every few months, to download a copy and test a restore, so you know the key works before you need it.

If you lose your key, your backups cannot be decrypted, not by you, not by us. Keep the recovery code shown at signup somewhere safe, a password manager is a good place. A new key can be created at any time; it protects backups made from then on.

07

Report a security issue

If you find a weakness in EdgeOwl, the setup script or the Relay, write to [email protected]. We answer within one working day and will tell you what we found and when it is fixed. Please give us a reasonable time to fix it before publishing.

[TODO: confirm the security mailbox and whether to publish a PGP key]