A service that runs as LocalSystem and sets firewall filters must be well secured itself. This is how we handle that – and your data.
Your data stays on the server
No telemetry. ServerBouncer sends no usage or crash data.
No outbound connections by default. The web UI lists every possible target; each can be switched individually and is off by default.
Fully offline. Geo and ASN data is read from locally imported files, signatures are verified offline.
Local database. SQLite on the server, or your own SQL Server or PostgreSQL (preview).
Diagnostics without upload. The diagnostics export is a ZIP with preview and optional redaction of IPs and user names – you decide whether and to whom you pass it on.
Data-minimal. User names in stored attempts can be kept as a salted hash; retention periods are configurable.
What ServerBouncer does not do
no cloud, no vendor account
no terminating processes or modifying services (behavior detection and system view are read-only)
no uploading files to VirusTotal – there is only a link your browser opens
Access to the web UI
Local by default
After installation the web UI listens on localhost only (HTTPS). The local administrator signs in there without a user account and without 2FA.
LAN only with 2FA
LAN access is opt-in. It requires a user account and always a second factor – passkey or TOTP. The admin key and local sign-in methods are refused from the LAN.
Step-up and roles
Consequential changes in LAN sessions require a fresh 2FA confirmation. Roles Reader, Operator and Admin; large whitelist ranges only for admins with confirmation.
Trust boundaries
Data folder:%ProgramData%\ServerBouncer gets its own protected ACL on every start (SYSTEM and administrators only). Foreign entries, junctions and symlinks are removed, never followed.
Secrets: protected with DPAPI, plus a random secret readable by administrators only.
CLI:sbc only talks to the service whose certificate is pinned (fail closed).
Port knocking: only packets with a valid Ed25519 signature of a registered device have any effect. Forged packets cannot get other addresses blocked.
Log data is attacker data: paths are limited to local absolute paths, regular expressions run with a timeout, overlong lines are truncated.
Proxy headers: requests with X-Forwarded-For or similar are never treated as local.
Independent security review
ServerBouncer has undergone an independent security review. The findings – among others on file permissions, certificate pinning in the CLI, step-up gaps, SPA forgery, user enumeration and memory exhaustion – are fixed or documented as known limitations. The code is built with the .NET analyzers, with security rules treated as errors.
We deliberately name no certifications: there are none at this time.
Questions about security?
We are happy to answer them as part of early access.