Understand what is protected and recorded.
Encryption, separate DNS settings and privacy choices, explained plainly.
The connection
WireGuard encrypts traffic from your enrolled device to the assigned VPN gateway. HTTPS continues to matter for the rest of the connection. The management website does not create a system-wide VPN tunnel.
The controls
Each workspace uses a separate DNS filtering instance. Domain rules do not inspect HTTPS pages, private messages or passwords. Encrypted DNS, another network or disabling a VPN can bypass controls on an unmanaged device.
The records
Raw DNS logging starts off. Owners can choose short retention after accepting an authorized-use disclosure. Account, billing, security and aggregate operational records are separate from raw DNS activity. The hosting operator retains technical control of the infrastructure.
Account protection
Owners and platform staff must enroll multi-factor authentication. Support access to sensitive tenant data requires a scoped, expiring and audited grant. Never share a device configuration or a recovery code.