Last week a client who runs a restaurant chain asked us a very direct question: “My daily takings all run over your networking channel — can you see them from your back end?” Fair question. It is also the one most owners keep to themselves and never voice before signing up for multi-site networking. So let us be upfront about who we are: we develop Yuxinan, a multi-site networking product, which makes us an interested party. That is why everything in this article about our own product comes with a way for you to check it yourself — no empty promises.
Here is the conclusion first: on the public internet leg, the data is ciphertext — anyone who intercepts it gets nothing but scrambled bytes, us included. At the transport layer, a proper networking product uses the same class of encryption thinking as banks do. Breaking it is roughly equivalent to trying every key in the world one by one; nobody does that in practice. The places where things actually go wrong are not on the “road” at all.
The real risks are these three, and none of them are on the transport path
Risk one: the key is stolen, not the lock picked. The vast majority of intrusions are not about cracking encryption, but about obtaining account credentials: weak passwords, passwords written on sticky notes, accounts of former employees that were never disabled. If someone has the key and walks in through the door, the best lock in the world is useless.
Risk two: a computer in the store gets infected. Encryption only covers the “road”; it cannot cover what happens before departure. If a POS terminal or an office computer is infected with a Trojan, the data is copied out before it is ever encrypted. The “payment data leaks” you often see in the news almost always trace back to the endpoint, not to transport.
Risk three: everything is reachable once you connect, because permissions are too broad. The old way of building a network was to bridge the two store networks wholesale. One infected machine then exposes every computer, camera and NAS on the other side. The right approach is to open only “the few systems that actually need to talk to each other” — POS stays with POS, surveillance stays with surveillance, with no crossover.
Three common approaches, and where their security differs
| Approach | What the data looks like on the public internet | One-line verdict |
|---|---|---|
| Free tunneling tools / plain port forwarding | Mostly cleartext, with the entry point exposed directly to the public internet, where scanners find it every day | Don’t run business data over it — don’t use it even if it is free |
| A self-built encrypted tunnel on a business router | Ciphertext; the security is adequate | No security problem; the barrier is that you need the skills to configure and maintain it |
| SD-WAN cloud networking (Yuxinan falls into this category) | Ciphertext, plus granular permissions and centralised management | The mainstream choice for chain stores; low maintenance |
How we handle it ourselves (every point is verifiable)
Only the points that are stated plainly on our public website:
- Encrypted end to end, with no entry point left on the public internet. The two ends of the network are joined by an encrypted tunnel, and you do not need to open any port forwarding on your router — which means a scanner sweeping the public internet cannot see that anything exists in your store at all; it cannot even find a “door”;
- Permissions are granted per person and per service, not all at once. Whose phone can get in, and which system it can reach (POS, surveillance or NAS), is authorised one by one. The finance phone can reach the POS and nothing else — it cannot touch surveillance;
- The provider cannot see the contents either. Both ends of the tunnel sit on your own devices, and what travels in between is ciphertext. Even when traffic goes through the cloud relay (the fallback path used when a direct connection between the two ends cannot be established; 2 Mbps on the free edition), the relay node still only handles ciphertext.
Don’t take our word for it — capture the packets yourself, it takes ten minutes
You do not have to take anyone’s word for this, ours included. Install the free trial edition of Yuxinan (¥0 forever, including an allowance of two endpoints, with hardware included in that allowance), then open a packet capture tool (Wireshark is free) on a branch-store computer, capture on the public-facing network adapter for two minutes, and open a batch of packets heading to headquarters — all you will see is encrypted gibberish, and not a single cleartext IP address or document content. Once you have done that, you will feel more certain than after reading ten articles. The boundary between the free and paid editions is set out in this article; if stability is your concern, see the stability piece; and the security position for accessing HQ NAS/ERP from home and from branches is covered in more depth in the security piece.
Four things you can do as soon as you get back
- Set strong passwords for the admin accounts of your networking platform, your router and the POS back office, and disable former employees’ accounts the same day;
- Install antivirus on POS and office computers, never plug in USB drives of unknown origin, and keep system patches enabled;
- Open only the systems that need to communicate — don’t take the easy route and bridge the entire network;
- Update your router firmware whenever an update is available; the known vulnerabilities of old firmware are public information.
Frequently asked questions
Q: If we use your networking service, can you see our business data from your back end?
A: No. The tunnel is encrypted at both ends on your own devices, and our servers only ever handle ciphertext. You can verify this yourself with the packet capture method described above — that is the most direct way.
Q: Is there any difference in encryption strength between the free and paid editions?
A: No. Encryption is a baseline, not a selling point, and the free edition is encrypted end to end just the same. The difference between the free and paid editions lies in bandwidth, the number of endpoints and management features — not in how secure they are. See the free edition comparison for details.
Q: How does multi-site networking differ from an ordinary VPN in terms of security?
A: A traditional VPN generally works on a “connect once, reach everything” basis — one entry point gives access to the whole network; networking products generally come with granular permissions that can be narrowed down to individual people and services. A fuller comparison is in the VPN comparison piece.
Q: Once we use multi-site networking, are we completely safe?
A: Don’t believe anyone who tells you that. Networking addresses the “road” and the “permissions” segments; endpoint antivirus, password management and the rest of the in-house work is still down to you — the four items above.
Prices and bandwidth for the free and paid editions of Yuxinan are as published on its official website as of October 2026.
