How it works and privacy

IXEL makes introductions. Your devices do the rest.

1. Keys. The first time IXEL Mesh runs, the device makes a WireGuard key pair. The private key never leaves it.
2. Sign-in. You approve the device with your IXEL account. It registers its public key with IXEL’s coordination service and receives its addresses and its own credential, so it keeps working even if sign-in is briefly unavailable.
3. Finding a path. The device learns the public address it appears from, using STUN on the same connection it uses for your traffic, and reports that along with its local network addresses.
4. The network map. The coordination service sends each device a live list of your other devices: their names, public keys, addresses and where they can be reached. Changes, like a device coming online or being removed, arrive within a second.
5. Connecting. Both devices send small signed probes to every address the other might be at, at the same moment. That opens a path through most routers and NATs. The first address that answers is used, and the encrypted session starts on it straight away.

What IXEL stores

To run your mesh, IXEL keeps:

• your IXEL account;
• each device’s name, computer name, system and IXEL Mesh version;
• each device’s public key and mesh addresses;
• the network addresses each device reported (local and public), used to connect your devices;
• when each device was last online;
• a log of device changes: added, renamed, removed.

What IXEL can’t see

• Anything your devices send each other. Connections are end-to-end encrypted between your devices and don’t pass through IXEL.
• Which of your devices talk to each other, or when.
• Your private keys.