Security and Private Access

Mindfront combines user and module permissions, private network access, and action governance. These are controls within Mindfront, configured for your organisation.

1. Private Network Access

Private access to your Mindfront server uses WireGuard. Each authorised device connects through an encrypted tunnel.

In a private deployment, the Mindfront application has no public internet endpoint. Anyone wanting to talk to it (a user, a connected mobile device, an admin from home) first has to be on the tunnel.

Standard Mode

Standard Mode is the default for day-to-day work. It tunnels only Mindfront data while everything else (web browsing, video calls, software updates) leaves on the local line as usual.

Full Coverage Mode

Full Coverage Mode routes every packet (mail, web, video) through the WireGuard tunnel into the mainframe: the user gets one encrypted path that hides location and blocks local snooping, and IT gets one audit point for traffic if the trip involves sensitive material. Typically requested for senior staff working from hotels, airports, or client sites where the network can’t be trusted.

Standard deployments issue split-tunnel profiles only, the gateway does not forward general internet traffic. Full Coverage is a per-deployment engagement: Mindfront reconfigures the WireGuard gateway for it on request.

Full Coverage can add latency. Use it when your organisation requires all traffic to pass through the gateway.

2. Device Management

Mindfront manages WireGuard access per-user and per-device. A user can have a laptop, a phone, a tablet, and a VR headset all connected at once, each with its own profile. Each device is tracked individually so an admin can revoke a single profile (e.g. a lost phone) without disconnecting the user’s other devices.

Per device, the system records:

• Which user the device belongs to
• Device type (computer, phone, tablet, headset)
• Public key, allowed IP, last-seen endpoint
• Data transferred in / out
• Last handshake timestamp (to check recent activity)
• Approximate geographic location (city + country) resolved locally from the endpoint IP via an on-appliance GeoLite2 database

Geographic location is resolved entirely on the appliance: no third-party IP-lookup API is called.

Beyond user devices, Mindfront also supports infrastructure peers, directly connecting routers (e.g. MikroTik) and dedicated gateway boxes (Raspberry Pi style) to the appliance, so a small office can have its whole local network reach Mindfront without per-user profiles.

3. Reverse Proxy for Internal Tools

Mindfront includes a reverse-proxy engine that lets Mindfront sit in front of your internal services: an on-prem ERPNext, a Frappe instance, a file share with a web UI, a custom dashboard, an internal API. The appliance terminates TLS (the cert is issued and renewed automatically) and forwards the request to the backend.

The effect: any internal service you put behind the private gateway inherits the same access posture as Mindfront itself: reachable over the tunnel in a private deployment.

Configuration is admin-controlled. Each proxied service has a label, a public DNS name, and a backend URI. Changes apply after a restart.

4. Outbound Action Gating

Action governance controls what Mindfront can execute. Every action Mindfront takes that touches the outside world: sending an email, updating a CRM record, calling a third-party API, triggering anything irreversible, carries a risk level. Low-risk actions (reading data, internal searches) run on their own. Mid-risk actions go through inline machine-tier triage that can:

• Approve the action and let it run, with the AI’s reasoning logged,
• Block it outright if the triage decides it’s unsafe, or
• Escalate to a human with a one-sentence explanation shown on the approval card.

Configurable thresholds set automatic execution, machine review, human approval, and refusal. Account adjustments change the effective risk. A loop can pre-approve an action or require human approval, but cannot bypass the refusal threshold.

5. Audit Trail

Infrastructure changes are recorded in an append-only audit log: peer created, peer updated, peer deleted, WireGuard server started, stopped, restarted, configuration reloaded. Peer events record the requesting admin and the peer state; updates include both before and after. Server lifecycle events record the operation. Bootstrap peer creation records a username. The log is stored in an append-only engine: no delete, no overwrite.

Outbound-action decisions (approved / blocked / escalated) are similarly preserved, including the AI’s reasoning, so an auditor can trace any action that touched the outside world back to the decision that let it through.

6. Controls at a Glance

Frequently Asked Questions

Will the VPN slow down my internet?

In the Standard Mode, no. Only Mindfront data travels through the tunnel; everything else uses your regular line.

Do I need the VPN every time I use Mindfront?

That depends on how your organization deployed Mindfront. In a private deployment the tunnel is the front door: if the tunnel is off, Mindfront stays locked. Organizations that expose Mindfront at a public address sign in directly with passkeys instead. Your administrator can tell you which applies.

How can I confirm the tunnel is active?

Check the latest handshake in your WireGuard client. access.mindfront.systems is the shared login and access entry point.

We already run a corporate VPN. How does Mindfront fit?

Mindfront supports private connectivity alongside a corporate VPN: Mindfront can run inside your existing tunnel, or you can keep both layers. Administrators decide what meets policy.

Can I connect from several devices at once?

Yes. Laptop, phone, and tablet can stay online together. Each device receives its own profile for clarity and control, and admins can revoke any single one without affecting the others.

Will Mindfront’s private connection hide my personal internet traffic?

In the Standard Mode, no. Mindfront’s private connection secures only the data that flows between your device and your company’s private Mindfront server. Everything else (web browsing, streaming, social media) continues to use your normal connection, exactly as before.

Your organization keeps full visibility of its own Mindfront data while avoiding any responsibility for your personal traffic.

If you need a tool that hides or re-routes all of your internet activity, you would use a consumer privacy service (for example NordVPN or Surfshark), or use the Full Coverage mode via special request to Mindfront.

Can I route all my traffic through the tunnel?

Not with a standard profile. The profiles your administrator issues are split-tunnel: they carry Mindfront traffic only, and the gateway does not forward general internet traffic. Full Coverage Mode is a per-deployment engagement that requires Mindfront to reconfigure your WireGuard gateway; if your travel or threat profile calls for it, raise it with your administrator. For everyday all-traffic privacy, a consumer VPN service is the simpler tool.

Is it safe to use Mindfront on public Wi-Fi?

Yes. Once the WireGuard tunnel shows “Connected,” every packet headed for Mindfront travels inside an encrypted WireGuard tunnel; anyone on the same hotspot sees only cipher text. The standard profile protects Mindfront traffic only: your web browsing, mail, and other apps still ride the open network unless you switch to a full-tunnel setup.

Which devices are supported?

Windows, macOS, Linux, iOS, iPadOS, and Android, via the free WireGuard app.

Can I connect automatically?

Yes. Enable “On-Demand” (iOS), “Always-on VPN” (Android), or auto-start at login on desktop clients.

Does the tunnel work over mobile data?

Yes. 4G, 5G, and tethered hotspots behave the same as Wi-Fi.

Can other users access my computer through Mindfront?

Mindfront blocks traffic from one WireGuard peer to another. IP forwarding is off by default; a firewall rule also blocks peer-to-peer routing when forwarding is enabled.

What if I lose a device with a profile?

Alert your server administrator. They will revoke the lost profile and issue a replacement. The other devices on your account stay connected.

Do I have to rotate keys on a schedule?

Follow your organization’s key-rotation policy. Your administrator can issue a fresh WireGuard profile when needed.

Does the VPN log everything I do online?

Only Mindfront traffic enters the tunnel. Session records stay under your company’s data policy. This data is governed by the same data policy as everything else in Mindfront. See “Your Data in Mindfront”.

Can I connect to my organization’s Mindfront when I travel abroad?

Yes. Almost anywhere.

A few places (mainland China, some corporate guest Wi-Fi chains) may block or interfere with WireGuard-based VPN connections.

If difficult areas are expected, Mindfront suggests asking your IT department for a fallback OpenVPN-TCP 443 profile into a bridged network to ensure your access to Mindfront is available.

What is “DNS” and why should I care?

DNS is the internet’s address book. Mindfront carries your Mindfront look-ups inside the tunnel to a resolver on the appliance itself, so the network you are sitting on never sees them.

The tunnel will not connect: what next?

Please contact your system administrator. They will likely ask you for the WireGuard log and request that you confirm if a handshake is detected on your device.

Can I use another VPN at the same time?

It depends on the VPN clients and their routes. Ask your administrator to check for route and DNS conflicts.

Plain-Language Glossary