Security & Data Sovereignty

How Registry OS protects your data, how licensing works without compromising sovereignty, and what, if anything, leaves your server.

Data sovereignty

Your registry data never leaves your server. Registry OS is a self hosted, single-tenant deployment. Domains, registrant contacts, DNS zones, EPP transactions, WHOIS/RDAP records, and billing data are stored exclusively in the PostgreSQL databases on the server you control.

• BorgLayer has no access to your database.
• There is no cloud dependency for registry operation.
• The system can run fully air gapped if desired.

Offline license validation

Licensing is enforced by a cryptographic key validated locally, not by contacting a license server. Each license is an Ed25519-signed token tied to your organization, your TLD, and an expiry date.

On startup the registry verifies the signature against a public key baked into the build. The private signing key is held only by BorgLayer and is never present on your server. Because verification is a local signature check, no internet connection is required and no usage data is transmitted for licensing. Enforcement cannot be used as a remote kill-switch dependent on connectivity.

Air-gapped operation

The registry can run with no outbound internet access: license validation is offline, the health heartbeat can be disabled, and DNS, EPP, RDAP, WHOIS, and the consoles all operate on your own network. A public ccTLD naturally needs public DNS reachability on port 53; "air gapped" here means no dependency on BorgLayer or third parties for the software to function.

Health heartbeat (optional, metadata only)

If enabled, the registry can send a periodic health snapshot so your vendor can monitor uptime. It is opt-in via two environment variables and can be left disabled.

• Contains: software version, aggregate counts, DNSSEC coverage, last-backup timestamp, uptime.
• Never contains: domain names, registrant data, DNS record contents, contacts, or billing.
• Authenticated by a per install token; rotatable or disable-able at any time.

Backups & data escrow

The included backup command (scheduled daily) dumps the registry database, the PowerDNS database, and a data-escrow export suitable for standard registry escrow obligations. Direct these to offsite, access-controlled storage and retain per your regulatory policy.

Cryptography

Security contact

Report security concerns to [email protected]. License and activation questions: [email protected].