Stored locally
Customer accounts, VPN keys and configurations, server records, plans, device slots, payment records, support tickets, traffic counters, settings, and audit data live in the installation database or managed files.
Data boundary
Your installation owns the operational customer record
VPN traffic path
Customer VPN traffic flows through the operator's selected servers. Flirexa does not proxy that traffic through a vendor-operated VPN network.
External providers
Payment, email, DNS, hosting, and app-store providers receive the data required by the services the operator configures. Their terms and regional rules remain independent.
Network contacts
Self-hosted does not mean every feature is offline
An operator should know which connections are part of the product and which can be disabled.
| Connection | Purpose | Data boundary |
|---|---|---|
| FREE runtime | Normal panel and VPN operation | No paid licence heartbeat |
| Installer diagnostics | Coarse phase and failure information used to support broken installations | Can be disabled with INSTALL_TELEMETRY=off |
| Update service | Fetch signed channel metadata and release packages | Version, manifest, and ordinary request metadata; package integrity is verified |
| Paid licence validation | Verify entitlement, limits, server binding, and current status | Licence/activation identifiers, derived hardware and instance identifiers, version/status metadata, and ordinary request metadata |
| Payment provider | Create and settle the operator's customer invoices | Invoice and buyer fields required by the configured provider |
| Outbound email | Activation, account, payment, and support messages | Sent through the mail service configured by the operator |
Paid and Lifetime licences
Perpetual use without a reusable static unlock
A Lifetime purchase is a perpetual entitlement for the licensed installation and tier. It still validates periodically to detect copied or reused commercial builds.
Each successful validation rotates a signed offline lease bound to the licence, persistent installation instance, and hardware. That lease can keep the paid installation operating for up to 30 days if the licence service is temporarily unreachable. Deleting a cache, restoring an old snapshot, or moving the clock does not create a fresh allowance.
A prolonged vendor-side incident can be handled with a short vendor-signed emergency lease for the same entitlement. Customers cannot self-sign or extend one.
FREENo licence key, expiry, or paid runtime heartbeat
SubscriptionBounded online enforcement with a 72-hour cached tolerance under normal conditions
LifetimePerpetual entitlement with a signed offline lease of up to 30 days after successful validation
MigrationA different machine requires an authorized licence transfer and hardware rebinding
Payments
A successful redirect is not a successful payment
Provider settlement is authoritative
Flirexa grants an operator licence or customer subscription only after re-reading a provider result and matching the settled invoice. A success URL, screenshot, or browser query parameter is not enough.
Retries are idempotent
Webhook delivery and provider polling can repeat. Settlement identifiers and database constraints prevent a verified payment from issuing or extending twice.
Pending recovery is conservative
The reconciliation job can re-check pending invoices after a dropped webhook. If provider connectivity fails, it alerts the operator and credits nobody.
Exact amounts are checked
The server stores and compares the expected amount and currency. Customer balance accounting uses integer minor units rather than binary floating point.
Update and recovery
Operational safety needs a tested restoration path
Signed release metadata
The updater reads an official signed manifest, verifies the release checksum, stages the package, and checks compatibility before replacing managed files.
State preservation
Official updates preserve the environment, database, licence state, server list, limits, and feature flags. Unsupported direct edits inside the managed product tree can be replaced.
Backup before change
Release and restore workflows create or require a recoverable state. Business adds scheduled backups and remote NFS/SMB storage administration.
A backup is only credible after a restoration rehearsal. Keep an encrypted copy outside the primary host, document the required external credentials, and test the service rather than checking only that an archive exists.
Questions
Security claims in plain language
Can Flirexa read my customers' VPN traffic?
Flirexa does not route customer traffic through a vendor network or upload traffic contents. Your hosting environment, DNS resolver, and any monitoring you add can still observe data according to their position and configuration.
Does licence validation upload customer records?
No. It does not upload the VPN customer list, VPN keys or configurations, traffic contents or counters, payment records, or portal user data. It does send the licence and installation metadata needed to validate the entitlement.
Are commercial modules impossible to copy?
No honest vendor can promise that on a machine where the customer has root access. Flirexa separates the commercial source, ships protected native components, and requires signed runtime entitlements. These controls raise the cost of copying and support enforcement; they are not described as mathematical impossibility.
Where should I report a vulnerability?
Use the private process in the public SECURITY.md. Do not post an exploitable issue, token, customer record, private key, or infrastructure credential in a public GitHub issue.