Loading…
Loading...
Multiple layers of cryptographic protection, a strict zero-logs architecture, and open-source protocols you can verify.
Military-grade symmetric encryption used by Shadowsocks 2022 and legacy protocols. The gold standard for bulk data encryption.
High-performance stream cipher used by WireGuard and AmneziaWG. Faster than AES on mobile devices without hardware acceleration.
VLESS and Trojan use TLS 1.3 with the Reality extension. Traffic fingerprint mimics real HTTPS connections to legitimate domains — undetectable by passive DPI.
Hysteria2 is built on QUIC with custom congestion control. UDP-based transport with TLS 1.3 inside — resistant to TCP fingerprinting.
We do not log which websites you visit, which services you use, or what data you transfer. Your browsing history is never written to disk.
Connection timestamps, session durations, and IP addresses are not recorded. We cannot tell you when you last connected — because we do not track it.
We retain only what is technically necessary: your account email, subscription status, and total bandwidth consumed for billing. Nothing else.
Per-device AdGuard Home DNS runs on our own infrastructure. DNS queries are filtered locally and not forwarded to third-party resolvers.
No shared PSK between server and client. Each connection is independently authenticated. Reality extension steals a real TLS certificate fingerprint from a target website.
WireGuard with obfuscated packet headers. Junk bytes (jc, jmin, jmax) and init header obfuscation (s1, s2) defeat statistical WireGuard detection. Header fields h1–h4 prevent fingerprinting.
Traffic is indistinguishable from TLS 1.3 to a legitimate HTTPS server. If an incorrect password is presented, the proxy falls through to a real web server — no detectable VPN error response.
AEAD-only, no legacy RC4/CFB modes. Session-based nonces prevent replay attacks. No identifiable packet structure — each packet appears random to a passive observer.
We rent and manage our own physical or dedicated virtual servers. No shared cloud hypervisors, no multi-tenant risk, no cloud provider snooping.
sing-box, AmneziaWG, and mtg v2 are open-source protocol engines running directly on our servers. No commercial VPN software with opaque internals.
All servers run UFW firewalls, non-standard SSH ports, fail2ban, dedicated service users (no root), and automated security updates.
Admin credentials and API keys are Fernet-encrypted at rest in the database. The encryption key is derived via HKDF-SHA256 and never stored alongside the data.
VLESS+Reality presents the exact TLS fingerprint of a chosen target domain (e.g., a CDN provider). DPI systems cannot distinguish this from legitimate HTTPS traffic to that domain.
Trojan wraps all traffic in a valid TLS session. The server hostname matches a real HTTPS site. Incorrect connections are proxied to that real site as a decoy.
AmneziaWG randomizes the WireGuard handshake headers and adds configurable junk packets. The standard WireGuard DPI signature is completely eliminated.
Hysteria2 uses QUIC (UDP-based), which is significantly harder to fingerprint than TCP-based protocols. Many DPI systems cannot inspect QUIC traffic at line rate.