FIPS Compliance for Government Contractors: What to Check First
Satcom companies, government contractors, federal agencies and any business handling Controlled Unclassified Information face the same hard requirement: the cryptographic module protecting data in transit has to be validated.
Speedify for Routers runs on OpenWrt routers, and Speedify also runs on Linux computers and servers. Paired with a Speedify Self-Hosted Server on infrastructure you control, Speedify keeps the combined traffic inside your own network boundary. This post covers how FIPS validation applies to software that combines internet connections, what Speedify’s encryption uses today, where Speedify fits, and how Speedify compares to Peplink, Cisco and Fortinet, with the Linux hardware it runs on covered further down this page.
Watch now
How Speedify combines internet connections on any hardware
Get started with Speedify for your business
Speedify offers three commercial paths. They work together, and most enterprise customers use two or more.
01
Speedify Teams
Speedify on every supported OS for every team member
Centralized dashboard for billing, user provisioning, and usage analytics
CSV import/export and a RESTful management API
02
Speedify for Routers
License for supported OpenWrt routers
Powered by Speedify hardware lineup ready to deploy out of the box
Miri, GL.iNet and other partner models
Covers every device on the network, with no per-device install
03
Embed Speedify into your product
A · DIY
Build it yourself with the Speedify SDK.
Integrate Speedify into your iOS, Android, Windows, macOS, Linux or QNX product. Full developer documentation, sample code and supported integration paths. Your team owns the build, and the Speedify SDK handles combining the internet connections.
B · CUSTOM ENGINEERING
Have the Speedify team build it for you.
What FIPS 140-2 and FIPS 140-3 Actually Require
FIPS 140-2 and its successor FIPS 140-3 define security requirements for cryptographic modules: the software or hardware components that perform encryption, key management, and related functions. NIST’s Cryptographic Module Validation Program (CMVP) issues the certificates. A product is FIPS-compliant when it uses a validated cryptographic module and operates in that module’s approved mode.
That distinction matters for software that combines internet connections. The CMVP validates the cryptographic module, not the full product. An application that combines connections and routes all cryptographic operations through a FIPS-validated module in approved mode can be part of a FIPS-compliant architecture. The logic that combines the connections (packet splitting, reordering, failover) is not a cryptographic function and is not in scope for FIPS validation.
One date matters: all FIPS 140-2 certificates moved to the CMVP Historical List on September 21, 2026. Since then, only FIPS 140-3 certificates count as current for new deployments. Procurement teams should verify certificate status directly against the NIST CMVP validated modules database before making a purchasing decision.
Speedify’s Encryption and Self-Hosted Server in a FIPS Deployment
Speedify runs on OpenWrt 23.05 or later routers and on Ubuntu, Debian and Raspberry Pi OS computers. Speedify’s tunnel encryption does not come from the operating system: Speedify encrypts traffic with DTLS 1.2 using AES-256-GCM or ChaCha20-Poly1305, implemented with Google’s BoringSSL. Speedify’s Self-Hosted Server runs as a Docker container on a Linux host (Ubuntu preferred), on bare metal in your own data center or on a cloud VM inside infrastructure the organization manages.
For compliance teams, this means you control where the traffic flows and where the data sits. With a Speedify Self-Hosted Server deployed inside your network boundary, combined traffic from Speedify clients does not transit Speedify’s infrastructure. Traffic flows from client devices to your server and stays within your environment, subject to your access controls, firewall rules, and logging policies. Device sign-in and server activation still use Speedify’s account service.
A self-hosted server inside the compliance boundary simplifies three conversations: data residency, because combined traffic ends in a data center or VPC the organization controls (relevant for ITAR technical data, HIPAA information and CUI); audit scope, because the server is part of the system under audit rather than a third-party dependency; and incident response, because the team has direct access to the server and its network traffic.
When auditors ask where traffic goes, the answer with a self-hosted deployment is specific: it goes to a server at a location you define, on infrastructure you manage, inside your existing compliance framework. Key deployment characteristics for compliance-sensitive environments:
- Activation and licensing. Speedify’s Self-Hosted Server is activated against a Speedify account and a Self-Hosted Server license, and Speedify’s setup guide does not cover running it without internet access. Confirm offline (air-gapped) operation with Speedify before planning an isolated network.
- Hardware agnostic. Speedify runs on OpenWrt 23.05 or later routers with x86_64 or aarch64 CPUs (with a Speedify Router License) and on Ubuntu 22.04 or later, Debian 11 or later and Raspberry Pi OS computers and servers. Organizations are not required to purchase specific hardware to deploy Speedify.
- Encryption library. Ubuntu’s FIPS mode does not change Speedify’s tunnel encryption, because Speedify uses its own BoringSSL library rather than the operating system’s cryptographic module. The checklist at the end of this post lists what to confirm before deployment.
- Self-Hosted Server requirements. Speedify’s Self-Hosted Server runs in Docker on an x86_64 Linux host with at least 2 CPU cores, 4 GB of RAM, 20 GB of storage and a static public IP address, with port 8443/TCP and ports 32768 to 65535 (TCP and UDP) open.
On the Linux side, check the exact platform against Speedify’s lists: the Linux app supports Ubuntu 22.04 or later, Debian 11 or later and Raspberry Pi OS Bookworm or later on ARM and x86_64, with the Raspberry Pi 5, 4 B and 3B+ tested. Routers need a Speedify Router License and run OpenWrt 23.05 or later, GL.iNet firmware on listed models, or a Powered by Speedify router such as the Miri X510; Speedify’s router support article (support.speedify.com/article/926) lists the models. The Self-Hosted Server installs with Docker Compose, with no hypervisor image or vendor VM format, on bare metal or a standard cloud VM.
Organizations That Need FIPS Encryption and Combined Internet Connections
Defense contractors operating under DFARS 252.204-7012 or CMMC Level 2/Level 3 requirements need FIPS-validated encryption to protect CUI. Combined internet connections are common in these environments: field offices, remote contractors, mobile work sites, and deployments where a single Ethernet or 4G/5G cellular connection is insufficient or unreliable. Speedify for Routers on an OpenWrt device combining 4G/5G cellular and Ethernet, connected through a Speedify Self-Hosted Server inside the contractor’s AWS GovCloud or on-premises environment, keeps the combined traffic on infrastructure the contractor controls. That settles where the traffic goes, not the FIPS requirement, which depends on the validation status of Speedify’s encryption.
Federal agencies and their contractors managing systems under FISMA or FedRAMP face the same question. The self-hosted deployment model puts the Speedify server component inside the agency’s or contractor’s own Authority to Operate (ATO) boundary.
Law enforcement agencies, state and local government entities, and businesses in regulated industries such as financial services and healthcare can use the same self-hosted model to keep combined traffic on their own servers. Where their rules require FIPS-validated encryption in transit, the same validation question applies.
Speedify Is Used on Millions of Devices Worldwide
Speedify has made internet connections faster and more reliable for businesses and individuals since 2014.
15M+
Speedify downloads worldwide75K+
5-star reviews for Speedify on iOS and Android82
Speedify server points of presence in 50+ cities on 6 continents500TB+
Of internet traffic carried by Speedify every weekSpeedify Partners
Speedify works with these companies to bring faster, more reliable internet and networking technology to their customers and employees.
Speedify vs. Peplink, Cisco and Fortinet for FIPS Environments
| Solution | FIPS-Validated Module | Hardware Agnostic | Self-Hosted Server Option | Air-Gap Compatible | Client Platforms |
|---|---|---|---|---|---|
| Speedify for Routers + Self-Hosted Server | No published FIPS certificate: Speedify uses Google’s BoringSSL; ask Speedify for current status | Yes: runs on commodity Linux hardware, OpenWrt routers | Yes: Docker container on Linux, bare metal or cloud VM | Not documented: activation uses a Speedify account and license | Windows, macOS, Linux, iOS, Android, OpenWrt |
| Peplink SpeedFusion + FusionHub | Yes: Peplink FIPS Module (CMVP #4763, FIPS 140-2 Level 1), moved to the Historical List on 9/21/2026 | No: SpeedFusion requires Peplink/Pepwave hardware on the client side | Yes: FusionHub virtual appliance | Partial | Peplink/Pepwave hardware only for SpeedFusion |
| Cisco Catalyst SD-WAN (Government) | Yes: Cisco FIPS Object Module; multiple active CMVP certificates; FIPS 140-3 transition in progress | Partial: software deployable, optimized for Cisco hardware | Yes: on-premises controller | Partial | Cisco-managed endpoints primarily |
| Fortinet FortiGate SD-WAN | Yes: FIPS 140-2 Level 1 and Level 2; transitioning to FIPS 140-3 | No: tied to FortiGate hardware for full SD-WAN | Yes: on-premises deployment available | Partial | FortiGate hardware / FortiClient |
Verify all certificate statuses against the NIST CMVP database before procurement.
What to Verify Before Deploying Speedify in a FIPS Environment
Before deploying Speedify in a FIPS-restricted environment, IT teams should confirm four things: the router or Linux server is on Speedify’s supported hardware list; the FIPS validation status of Speedify’s own tunnel encryption, which uses Google’s BoringSSL and has no published FIPS 140-3 certificate; the Speedify Self-Hosted Server sits inside the organization’s compliance boundary; and the network path from each Speedify client to that server fits the organization’s network design and security policy. Speedify’s sales team can help scope a deployment for a specific compliance environment.
Speedify Business Solutions
Speedify Teams
Speedify for Routers
Speedify Embedded Solutions and Integrations
Add Speedify to your own app or hardware with the Speedify SDK. Your product then combines internet connections, fails over automatically when one drops, and encrypts the traffic, using the same technology as the Speedify app.