Transparency & trust

No-logs — verifiable

• We don't log client IPs or keep traffic logs. There are no per-user metrics — only aggregate throughput on the node (for QoS).
• The DNS resolver on our nodes runs with no logging.
• An account is just a number (≥60 bits of entropy). Email is optional; we never ask for a name.
• The "no PII in logs" policy is guarded by an automated CI gate plus a scrubbing filter on every application logger.

RAM-only servers

• A node's disk holds no user data, no client keys and no traffic logs. Private keys are generated in your browser — only the public key ever reaches the server.
• No swap, systemd journals in RAM, no-log DNS, full-disk encryption.
• The only thing a node keeps on disk is its own WireGuard identity (the server key), so it survives a reboot without dropping clients. That is not user data.

Warrant canary

Standing declaration. As of the last signature, the operator states that they:

• have NOT received national security letters, gag orders or secret court orders;
• have NOT been required to install interception or logging equipment;
• have NOT handed over keys or altered the cabinet/agent code under duress;
• retain control of the infrastructure; nodes remain RAM-only.

Freshness: the document is updated and PGP-signed by the operator every 14 days, referencing a recent Bitcoin block header (proof of date). A missed update or a removed statement should be read as a signal. The signed version with proof-of-freshness is published on the site, over .onion and in the repository.

External audit

Not done yet — honestly. An independent audit of the code and infrastructure is on the roadmap; we'll announce the auditor and date right here.

Open source

We plan to open-source the cabinet, config generator, agent and provisioning — part of the trust strategy. The browser keygen is published first. Until the code is public, we don't present openness as an accomplished fact.