Zero logs is a design constraint, not a promise
A logging policy is only believable if the software could not log even when asked. Here is the line we hold: what is never collected, never leaves the box.
Every VPN advertises zero logs. Very few explain what would happen if an operator decided to start logging tomorrow. That gap is where the interesting engineering lives.
Three kinds of "no logs"
- Policy no-logs. The software is capable of logging and the operator promises not to. This is a trust relationship with extra steps.
- Deletion no-logs. Logs are written and rotated quickly. Useful, but the window exists and the disk remembers.
- Architectural no-logs. The data path has nowhere to put a log. Nothing to delete, nothing to hand over.
Only the third holds up when the operator changes hands, changes country or changes its mind.
What the exit node actually knows
An exit node forwards packets. To do that it needs a route, a key and a counter for the bytes it moved. It does not need to know the destination of a request, and it does not write it. The accounting that decides whether you have quota left is a running total per wallet, not a transcript.
Liveness without surveillance
A network still has to know which exits are alive. The naive approach is a heartbeat that stores timestamp, address and latency — a log by another name. A forwarding proof does the same job with none of that: the node has to demonstrate it can relay a packet, and the result is a boolean.
The parts we cannot promise
Your device still talks to its local network, your DNS resolver still sees the queries you send outside the tunnel, and the website you visit still sees the exit IP. A VPN moves who can see what; it does not delete the concept of an observer.
Why this matters for regulators
Lawful requests are answered with what exists. When nothing exists, the answer is short and it stays true regardless of who asks. That is a better position for a small operator than a promise that depends on goodwill.
How to check us
The client is open, the protocol is textbook WireGuard-style, and the HTTP/3-only transport is documented. Point the app at one exit, run a packet capture on your own machine and see where the tunnel goes. Independence beats assurances.