One tunnel, twenty-one disguises, and nothing that has to phone home
The engineering here answers two questions. How do you get through a network that is actively looking for you? And how do you sell a subscription without building the exact database a subscription normally requires?
Getting through
A transport is a costume. Underneath, every connection is the same Noise-style handshake in which both sides contribute an ephemeral key, so recording today's traffic and stealing a server key next year does not decrypt it. Nonces are counters, every frame header is authenticated, receivers keep a replay window, and the sending key ratchets forward as a session runs.
What changes between transports is only what an observer sees. The TLS carrier looks like an HTTPS session to an ordinary website. The WebSocket carrier looks like a web app holding a socket open. The DNS carrier looks like a device asking a resolver a lot of questions. A filter that drops one of these has not dropped the others.
On connect, the client dials several of them concurrently rather than in sequence, because on a censored network a failed attempt often does not fail quickly — it hangs until something times out. Racing means the slowest failure costs nothing. The first transport to complete a handshake wins, the rest are dropped, and the winner is remembered against that specific network so the next connection starts with the answer instead of the question.
Not knowing who you are
The usual design is that a VPN client authenticates to an API, the API checks a subscription, and the server asks the API whether to let you in. That last step creates a record — an account, a server and a timestamp in one place — every single time anyone connects. No retention policy removes the fact that the system is built to produce it.
We invert it. The control plane issues your device a short-lived signed token stating your plan's limits: speed ceiling, data allowance, which transports, which class of exit. The exit server holds the public key to verify that signature and nothing else. It decides admission locally, in microseconds, without a network call — so there is no moment at which "this account connected here" is a thing anyone needed to write down.
The token is bound to your device's key by a signature over material from the live handshake, so copying it somewhere else does not make it usable. It expires in hours. Cancelling a subscription stops the next one being issued, and a revocation feed handles the rare case where something must stop sooner.
What that costs
Honesty about the trade-offs, since a page like this usually skips them. Because exits verify offline, an entitlement revoked mid-hour remains valid until it expires or the revocation feed reaches the node. Because your account has no recovery address, losing your account code and your device at once means losing the subscription — we cannot identify which account was yours. Because metered plans must be metered, exits count bytes per account and report a daily total, which is the smallest number that makes a quota possible.
Choosing where you exit
You can pin a country, or leave it automatic. Automatic ranks the fleet by what your device has actually measured — round-trip time, recent failures — ahead of any hint we publish, because our estimate of your network is worse than your device's measurement of it. The server list itself is a signed document your client caches, so adding capacity does not need an app update, and a tampered list does not verify.
Where it runs today
The pilot fleet is two exits, in Frankfurt and New York, with the control plane on a separate host. That is deliberately small: it is enough to prove that country selection picks correctly between genuinely different paths, and small enough to change quickly. The fleet grows as the pilot does.
A VPN is not anonymity. It moves the point at which your traffic joins the internet, and it stops the network you are on from reading it. It does not stop a website recognising you when you sign in, it does not defeat browser fingerprinting, and it is not a defence against an adversary who can watch both ends of a connection. Anyone who tells you otherwise is selling something.