Security

How CloudTunnel protects you

Plain-language detail on the encryption, the keys, DNS, and what happens on our servers.

Encryption

Traffic between your device and our server is encrypted with modern, audited primitives (ChaCha20-Poly1305 for data, Curve25519 for key exchange). Each session uses fresh keys, so even if one key were exposed, past sessions stay private.

Your keys

The app generates a key pair on your device. Only the public half is sent to us so the server can recognise your device. The private half never leaves the device and is deleted when you remove the device from your account.

DNS

Every exit server runs its own resolver that only answers inside the tunnel. Your DNS questions never travel to your ISP or a third-party resolver, and the resolver keeps no query logs.

On the server

No logs

No source IPs, timestamps, destinations or DNS queries are written. See the no-logs policy.

Idle peers removed

Device entries that stop talking to a server are removed automatically within minutes.

Minimal software

Each exit server runs the tunnel, a resolver and a small agent. Nothing else.

Hardened hosts

Firewalled, key-only SSH, automatic security updates, no shared hosting.

Independent control plane

Account and billing data lives on separate systems from the exit servers.

Responsible disclosure

Found a problem? Email [email protected]. We respond within 48 hours.

Read the no-logs policy

The exact list of what we do and do not keep.

No-logs policy