The parts that decide whether a VPN is worth installing

A VPN moves your trust from your internet provider to us, so the logging policy matters more than any feature list. We do not store your browsing history, destination addresses or traffic contents. The policy is self-declared today; we will publish an independent audit when one is completed rather than imply one already exists.

Every tunnel uses current, well-reviewed ciphers with forward secrecy. Nothing bespoke, nothing home-rolled — the value of a VPN comes from using the algorithms the rest of the security world has already spent years attacking.

Without a kill switch, a dropped tunnel silently falls back to the network you were hiding from. DESEO blocks traffic until the tunnel is re-established, so a moment of instability never becomes an hour of exposure.

WireGuard is lean and fast, OpenVPN is the most compatible on restrictive networks, and IKEv2/IPsec reconnects fastest when you move between Wi-Fi and cellular. On iOS at launch the app uses IKEv2/IPsec; WireGuard on iOS arrives once Apple grants our Network Extension entitlement.

DNS is the most commonly leaked part of a VPN connection: the tunnel is encrypted but the lookups escape to your provider's resolver. DESEO resolves names inside the tunnel and blocks IPv6 and WebRTC paths that route around it.

Some things belong outside a VPN — your bank's app, a local printer, a work tool that blocks non-domestic addresses. Split tunnelling lets you protect everything else without switching the VPN off, which is what people actually do when a VPN gets in the way.

We will not print a server count or a country count that we have not verified, and we will never round one up. The Servers page lists exactly what exists, and stays honest about what does not yet.

One subscription covers five simultaneous connections, so a phone, a laptop and a tablet do not need separate plans. Apps for platforms beyond iOS are in development — each one lists its own status.