Technical details about European operation, encryption, access and service dependencies. Last updated October 28, 2026.
Security history and incident support
The customer security log records account and device access metadata, authorisations, administration outcomes and supported client session reports. Account and device identities are distinguished. Client reports describe what the authenticated device reported; they are not presented as independently verified individual user identities.
An isolated local service owns the event store and signing key. The web application can append events through a restricted interface and cannot directly rewrite the stored history. Hash chains, signed export manifests and checkpoints support integrity verification against a separately trusted public key. Retention pruning is a documented operation; these protections are not a guarantee against every host compromise or operational failure.
The account holder can filter and export retained events, acknowledge alerts and issue expiring read-only integration credentials. Sensitive server actions require a durable audit intent when collection is enabled. A missing completion record raises an alert rather than being labelled as confirmed success. Audit availability is monitored separately from application request handling, and the ledger is included in the encrypted off-site backup process.
These functions support customer security and incident work. Applicable NIS2/cybersecurity duties depend on the organisation and service classification, its risk management and operating procedures; use of Flashlink alone does not establish compliance. The privacy policy describes the data and retention arrangements.
European infrastructure and operation
Flashlink AB is a Swedish company. Its VPN, relay and core account infrastructure uses OVHcloud European hosting. The external backup endpoint is in Germany. These descriptions identify the infrastructure and operator used for those functions.
European hosting is distinct from complete independence of every external supplier, jurisdiction or political decision. Flashlink does not provide a guarantee of immunity from legislation, sanctions, supplier restrictions or interruptions affecting the service.
Account, payment and delivery services
The current service uses Stripe for payments, Cloudflare Turnstile for website abuse prevention, Resend for service email and Sentry for diagnostics. Google and Microsoft sign-in are optional identity services. Software delivery and signing may involve additional providers.
These providers do not replace the European VPN and relay hosting. They can nevertheless affect registration, account sign-in, email delivery, billing, paid capacity or software delivery. Password sign-in also uses Turnstile; choosing it does not remove that dependency. The whole service is not currently verified as free from non-European technology or governance dependencies.
Tunnel encryption and hybrid key establishment
WireGuard provides encrypted tunnel transport. Supported Flashlink tunnels use a preshared key derived with ML-KEM-768 alongside WireGuard's classical cryptography. ML-KEM is standardised in NIST FIPS 203.
The hybrid protection description applies to supported tunnel key establishment. Website HTTPS, account authentication and update signatures use their own mechanisms. Older connections must be migrated and checked before they are described as using this design. No absolute security guarantee or blanket post-quantum authentication claim is made for every subsystem.
Traffic and the relay trust boundary
Flashlink does not intentionally inspect or store remote-access traffic content as a routine analytics activity. Connection metadata, device discovery information and traffic-volume counters are separate categories of operational data.
When traffic is relayed, Flashlink infrastructure remains within the connection's trust boundary. Encrypted transport is not a guarantee that all data is technically inaccessible to Flashlink. Retention, recipients and data protection roles are described in the privacy policy.
Automatic SSH access
On supported Node installations, Flashlink configures SSH access so an authorised Master can open a terminal through the private Flashlink tunnel. Availability requires a connected, correctly installed Node and an active authorised Master session.
SSH uses short-lived, Node-specific key authorisations and checks the Node's enrolled host identity. The automatic setup description does not grant access to arbitrary devices or bypass operating-system permissions and installation requirements.
Controllers and viewers
Several connected operators can view the same remote resource. One operator controls input at a time and viewers can request control. This describes shared-session roles; it is not a promise of unrestricted simultaneous input or support for every physical multi-monitor arrangement.
Updates and security reports
Keep supported clients, operating systems and device configurations updated. Customers must only access resources they own or are authorised to administer. Necessary consumer rights and any separately agreed service commitments remain applicable.
Report a suspected vulnerability to support@flashlink.tech with the affected version and a minimal description. Do not include secrets or other customers' data in the first message. Reporting instructions are not general permission to test systems without authorisation.