How your traffic is protected

In flight

The tunnel is WireGuard — X25519 key agreement with ChaCha20-Poly1305 — between your device and the exit node, and it is not decrypted anywhere in between. The kill switch is installed before the handshake starts, so nothing leaves your device in the clear while a connection is coming up.

The control channel that carries entitlement and server lists uses a separate NIST P-384 suite, and server list signatures are verified independently of TLS rather than trusting the transport.

At rest

We are required to retain certain subscriber and connection details. That store is encrypted at rest and access-controlled, and every access to it is written to an audit log. It is the most sensitive thing we hold and we treat it that way.

Server keys are generated on each machine at boot and rotate every time it restarts, so there is no fleet-wide key to steal.

Reporting a vulnerability

Contact details for security reports go here. This page needs a real address and a disclosure policy before launch.