SECURITY

Privacy you can inspect.

WireGuard encryption, on-device keys and clear protection controls — with an honest explanation of iOS limitations and our logging policy.

Current iOS app · TestFlight

Protection controls, with clear limits

WireGuard and keys. EVPN encrypts the path between your device and its gateway. A fresh WireGuard keypair is generated on the device for each new connection; the private key stays there. Encryption beyond the VPN exit still depends on the application protocol, such as HTTPS.

Kill Switch. When enabled, EVPN asks iOS to keep traffic inside the VPN if the tunnel drops unexpectedly. iOS may still exempt local networking, push notifications, cellular services and some device communication. This is not Apple Always On VPN and is not a guarantee that every system packet is blocked.

Auto-connect. The app can connect when a network is available. Manual Disconnect pauses auto-connect until you tap Connect again. Do not treat a manually disconnected device as protected.

DNS choice. Use EVPN DNS or a supported custom IPv4 DNS server while connected. Choosing a third-party resolver also means choosing that provider’s DNS privacy policy.

See current controls and planned capabilities →

A · Threat model

What EVPN is designed against

  • Hostile public Wi-Fi
  • Local network observers
  • Routine ISP visibility into destination traffic
  • DNS leakage
  • Accidental traffic leakage when VPN protection is enabled

B · What EVPN protects

The path to the VPN gateway

  • Traffic carried between your device and the VPN gateway
  • DNS requests configured to use the VPN tunnel
  • Your originating public IP from normal destination websites
  • Routing protection where supported, subject to the iOS exceptions above

C · Limits

What a VPN cannot guarantee

Transparency matters more than slogans. EVPN cannot guarantee:

  • Anonymity against a global passive adversary
  • Anonymity after users sign into identifiable accounts
  • Protection from malware already installed on a device
  • Prevention of browser fingerprinting
  • Secrecy for plaintext HTTP after traffic leaves the VPN exit
  • Universal streaming access
  • Universal censorship resistance
  • Immunity from lawful infrastructure seizure

D · Architecture separation

Who should not know where traffic goes

Installation / Promotions

|

Authorisation

|

Short-lived capability

|

VPN Gateway

|

Private DNS

|

Internet

The system that serves a promotion should not be able to reach the system that carries your traffic.

E · Logging policy

Collect less on the data plane

Never intentionally logged

  • — Browsing history
  • — Destination history
  • — DNS query history
  • — Packet contents
  • — Per-session traffic history
  • — Account-linked connection history

Operational metrics (aggregate)

  • — CPU
  • — Memory
  • — Tunnel counts
  • — Aggregate throughput
  • — Packet loss
  • — Gateway health
  • — Service errors

This describes the VPN data-plane policy, not the absence of all installation, service or website data. See the Privacy Policy for those distinctions. This is not a claim that infrastructure has already been independently audited.

F · Audit / transparency

Current state

NOT YET AUDITED

Target transparency work includes external application review, infrastructure/no-logging audit, published remediation and a clear vulnerability-reporting path. Dates and providers will be named when engagements are real — not before.

G · Research

Future work, clearly labelled

Research

Transport agility / MASQUE

Exploring additional transports for restrictive networks.

Research

Traffic-analysis resistance

Research into reducing observable traffic patterns where practical.

Research

Post-quantum research

Hybrid key-exchange and hardening as standards mature.