Security
Technical details about how we protect your data and traffic
Proxy architecture: pure CONNECT tunneling
Our proxy server implements the HTTP CONNECT method per RFC 7231:
- Your client sends
CONNECT destination:443 HTTP/1.1to our proxy. - The proxy opens a TCP connection to the destination server.
- The proxy responds
200 Connection established. - Your client starts the TLS handshake directly with the destination.
- The proxy forwards encrypted bytes without decrypting them.
Result: your TLS session is end-to-end encrypted between the client and destination. The gateway does not terminate or decrypt that session.
Authentication
- →API keys: Generated with 192 bits of cryptographic entropy. Stored as a SHA-256 digest; the plaintext key is shown once at creation.
- →Proxy auth: Proxy passwords encrypted with AES-256-GCM. Key stored separately from database.
- →Transport: The API and dashboard use HTTPS. Port 443 is the recommended TLS-protected proxy endpoint.
Infrastructure
| Component | Detail |
|---|---|
| Datacenter | Swedish core operations; the current supplier chain is listed on the Subprocessors page |
| Database | PostgreSQL with restricted system access and separate application permissions |
| Network isolation | Proxy nodes isolated from API servers via separate network segment |
| Security patching | Operating systems and dependencies receive ongoing security maintenance |
| Access control | Principle of least privilege for all personnel and systems |
Responsible disclosure
Found a security vulnerability? Contact us at hello@proxyapi.se. We handle all reports confidentially and respond within 48 hours.