Privacy. It’s built into every byte.
We believe privacy is a fundamental human right. NexusLB is architected from the bare metal to ensure your data, your clients’ traffic, and your network telemetry remain exclusively yours.
App Privacy Nutrition Summary
NexusLB does not collect any data or metrics from this proxy binary or website.
Zero client identity, IP address, user-agent, or geolocation records are retained externally.
Zero tracking identifiers, cookies, or device fingerprinting routines are embedded.
Architectural Guarantees
Zero Remote Telemetry
NexusLB contains no analytics SDKs, no phone-home mechanisms, and no remote heartbeat pings. Your traffic metadata never leaves your infrastructure.
Ephemeral Memory Only
Zero-allocation byte-slice streaming handles HTTP requests entirely within pre-allocated RAM ring buffers. No request or response bodies are written to unencrypted disk.
Cryptographic Isolation
Hardware-accelerated TLS 1.3 termination with ephemeral forward secrecy (P-256, X25519). Private keys are loaded strictly into memory and never logged.
100% Air-Gapped Operation
NexusLB requires zero internet access to validate licenses, boot, route traffic, or export metrics. It operates flawlessly inside isolated VPCs and defense-grade enclaves.
1. Information NexusLB Does Not Collect
Unlike many commercial reverse proxies and cloud ingress controllers, NexusLB does not include any proprietary telemetry probes, diagnostic crash reporters, license checking callbacks, or usage tracking. When you download and run the compiled NexusLB binary, it establishes network connections strictly and exclusively to the listener addresses and upstream backend targets that you define in your configuration file.
2. HTTP Traffic & Zero-Allocation Ingress
NexusLB operates as an in-memory streaming proxy using zero-allocation byte slices and pre-allocated circular ring buffers. When an HTTP/1.1 or HTTP/2 request is parsed via SIMD-accelerated httparse, header mutations and URI rewrites happen strictly in volatile RAM. No request payloads, body streams, cookies, or authorization tokens are persisted to local disk, caching drives, or external logging servers unless you explicitly configure the local access logging filter.
3. Local Access Logs & Metrics Storage
When access logging is enabled in your configuration (`nexuslb.yaml`), log records (timestamp, method, path, status, latency) are written directly to your local file descriptor or stdout. NexusLB provides a native Prometheus metrics endpoint (`/metrics`) and an operator TUI (`nexuslb top`). All metrics are computed via atomic hardware registers (`AtomicU64`) within memory. No external metric aggregators receive this data unless scraped by your own authenticated monitoring system.
4. Compliance by Architecture (GDPR, CCPA, HIPAA)
Because NexusLB does not store, process, or transmit personal data to any third parties, it inherently complies with the strictest global privacy regulations:
- GDPR (EU): NexusLB acts purely as an agnostic data pipeline. It requires no Data Processing Addendum (DPA) because zero personal data is gathered by the project or developers.
- CCPA / CPRA (California): Zero personal information is sold, shared, or collected.
- HIPAA (Healthcare): Safe Rust memory guarantees prevent buffer overflow vulnerabilities, and end-to-end TLS 1.3 encryption prevents ePHI interception in transit.
5. Website & Documentation Usage
This official documentation website is hosted on high-performance static infrastructure. It uses no tracking pixels, no marketing cookies, no Google Analytics, and no advertising beacons. Any preferences (such as documentation search queries or dismissal of the privacy notification pill) are stored exclusively in your browser’s `localStorage` and never transmitted across the network.
6. Contact & Security Inquiries
If you have questions regarding this privacy policy or would like to report a security consideration, please review our Product Security documentation or contact the maintainers at security@nexuslb.dev.