Privacy Policy
This Privacy Policy explains how Mikrodius (“we”, “our”, or “platform”) collects, processes, isolates, and protects telemetry data from operators, network access servers (NAS), and subscriber accounting sessions.
Scope & Architecture
Mikrodius provides a multi-tenant Cloud RADIUS (RFC 2865, RFC 2866, RFC 3576) and network management control plane. Our architecture operates via secure encrypted tunnels (WireGuard UDP 51820 on 10.8.0.0/16 and L2TP UDP 1701 or SSTP TCP 4443 on 10.9.0.0/16) connecting Customer Edge Routers (NAS) to centralized authentication daemons.
This policy governs data processed across all Mikrodius properties, including the Web Console (console.mikrodius.com), the Marketing Apex (mikrodius.com), the REST API (/api/v1), and our RADIUS daemons (UDP 1812/1813/3799).
Information We Collect
We collect only the technical and billing data necessary to operate high-throughput AAA signaling and manage your workspaces:
When you authenticate via Google OAuth or credentials, we receive your email address, full name, profile avatar URL, and an immutable tenant UUID. Passwords for local operator accounts are hashed using modern cryptographic algorithms before persistent storage.
To maintain VPN tunnel connectivity and route RADIUS Access-Requests, we record router identifiers, hardware names, RouterOS versions, static VPN tunnel IP assignments (e.g., 10.8.0.42), public peering endpoints, and RADIUS shared secrets.
Standard RADIUS RFC 2866 accounting packets transmitted by your routers contain session attributes: subscriber username, MAC address (Calling-Station-Id), assigned IP (Framed-IP-Address), session start/stop timestamps, termination reason, and octet transfer volumes (input/output byte counts).
Zero Payload Inspection Guarantee
Mikrodius is strictly a control plane for AAA signaling and tunnel termination. We do not act as your internet upstream or transit proxy. Subscriber internet traffic does not flow through our cloud servers. We do not perform Deep Packet Inspection (DPI), we do not monitor URLs or domain requests, and we do not store payload content.
Platform Credits & Billing Data
When you top up through any of the payment methods available where you use Mikrodius, the transaction is governed by our strict Platform Credit policy:
All deposits are irrevocably converted upon confirmation into digital Platform Credits. Platform Credits are strictly non-refundable and can only be used to purchase, or renew services within the Mikrodius platform (including subscriber access charges). Credits cannot be cashed out, withdrawn, or transferred to external accounts.
For compliance and audit purposes, we maintain an immutable ledger in our database (wallet_transactions) recording: transaction timestamps, credit additions (TOPUP_CREDIT), usage debits (USER_ACTIVATION_DEBIT), merchant reference strings, and the resulting credit balance. We do not process or store sensitive credit card numbers or banking passwords.
Welcome credit and fraud prevention. New accounts may claim a one-time welcome credit that expires 30 days after it is claimed; any unused part is then removed from your balance. To stop the same business from claiming it repeatedly with new accounts, we keep a one-way hash (SHA-256) of the subscriber device MAC addresses seen in your RADIUS accounting, never the MAC addresses themselves, and compare them across accounts. A strong overlap with an older account is reviewed by our staff and may lead to the account being suspended. These hashes are used only for this purpose and are never shown to other customers.
Referral links. When you arrive through a link that carries a referral code (for example from a billing app's plugin), we keep that short code in a first-party cookie (mk_ref, 30 days) and record it on your account if you sign up. It tells our staff which channels bring new customers; it is not shared with anyone and holds no other information.
How We Use Information
- Authentication & Virtual Matching: To match incoming RADIUS packets from router VPN tunnel IPs to your workspace in O(1) time without requiring legacy port-mapping.
- Bandwidth & Profile Enforcement: To inject MikroTik-Rate-Limit vendor-specific attributes (VSAs) matching your configured speed profiles.
- RFC 3576 CoA Disconnect Execution: To transmit dynamic disconnect requests on UDP 3799 when vouchers expire or operators terminate active sessions.
- Automated Workspace Billing: To automatically deduct recurring workspace subscription costs from your Platform Credit balance every 30 days.
- Security Auditing: To safeguard the platform against credential stuffing, tunnel tampering, and unauthorized access attempts.
Defense-in-Depth Isolation
Mikrodius enforces multi-layered technical boundaries to prevent cross-tenant data access:
Our VPN Gateway enforces strict firewall rules (iptables -A FORWARD -i wg0 -o wg0 -j DROP). Customer routers connected over WireGuard, L2TP or SSTP cannot discover, ping, or communicate with each other.
PostgreSQL queries strictly enforce tenant scoping with composite constraints (UNIQUE (radius_server_id, username)). No tenant can query or view another tenant's subscribers or accounting records.
Data Retention & Sovereignty
Subscriber records, plans, NAS credentials, session history, sales estimates, and wallet transactions are stored without an age-based time limit, regardless of payment status. Records are removed through explicit deletion rather than automatic expiry.
When a workspace or tenant account is permanently deleted by an operator, all associated router configurations, WireGuard peering keys, subscriber credentials, and session logs are permanently erased from our active databases within 48 hours.
Operator Rights & Controls
As a network operator on Mikrodius, you maintain the following controls over your data:
- Data Export: You can export subscriber and voucher lists as CSV from the console, and read every subscriber, session and usage record through the REST API.
- Secret Rotation: You can regenerate RADIUS shared secrets and VPN keys directly through the console dashboard, then run the new install command on the device.
- Account Erasure: You may request complete account termination and associated record deletion by contacting platform administration.
Key Takeaways & Privacy FAQ
Interactive clarification on our privacy architecture, payload boundaries, and credit handling.