Features
Every feature exists to keep one promise: no one — including us — can tie your traffic to you.
Android always-on + block-without-VPN, iOS includeAllNetworks, desktop firewall rules. DNS and IPv6 never leak.
WireGuard (ChaCha20-Poly1305) with a fresh ML-KEM-768 pre-shared key on every connect, against harvest-now-decrypt-later.
WireGuard over QUIC or TLS on port 443 and obfuscated handshakes. Switches on automatically after two blocked attempts.
Entry and exit in different providers and countries. The exit never sees your IP address.
Diskless images, measured boot and TPM attestation. Reboot = clean. Unattested servers are labelled and excluded from Privacy mode.
We announce our own prefixes with valid RPKI ROAs and publish an RFC 8805 geofeed, so streaming and location are correct.
Malware, phishing and tracker blocking on each server's own resolver. No query log.
Sign up with no email at all — just a 16-digit number. Or use a passkey.
A static IP that is yours alone. This is the one account↔IP link we keep, and we tell you so before you buy.