Who you still need to trust#
| Boundary | What remains your responsibility |
|---|---|
| Your device | Protect device access and backups. Local encryption is not protection against every compromised-device scenario. |
| Deployment owner | Choose the intended owner and compare their fingerprint independently. An operator can revoke access to their own deployment. |
| Hosting provider | A VPS is hosted on someone’s infrastructure. Do not infer an absence of hosting logs or visibility from a product architecture claim. |
| Software and updates | Inspect source, build provenance and exact artifact identity. Open source alone is not an independent audit. |
| Internet services | A VPN is not a guarantee of anonymity to sites you sign in to, or immunity from all traffic analysis. |
Three kinds of custody#
The source describes a deployment-local root, an online issuer and a relay identity. The root private key belongs in the passphrase-encrypted recovery artifact. Online issuer and relay keys live in owner-only encrypted local state.
Android device enrollment is different: the phone exports a public request so the owner can issue a recipient-sealed profile. The client does not become the deployment administrator.
Technical details
The self-hosting security guide explicitly describes software key custody, not a mandatory hardware-backed TPM, PKCS#11 or HSM arrangement. Do not market optional future adapters as current hardware security.
Fail closed is not a blanket phone-wide promise#
The runtime is designed to reject invalid authority rather than bypass signature, expiry, replay or revocation checks. That is distinct from Android’s system-level control over traffic outside the VPN.
Read DNS and routing boundariesRead recovery guidanceWhat has not been established#
The repository describes internal adversarial, mutation, parity and security test tooling. The reviewed material does not establish independent release-candidate assurance or broad physical-device and hosting-provider validation.
This page is a source-backed explanation of assumptions, not a new formal threat-model certification or an independent assessment of the implementation.
Source and scope
Reviewed . The linked source describes the implementation; released-build evidence is a separate check.