Trust centre
Designed to know nothing about you
The best protection for your data is not to have it. Here are the technical choices already made, and what remains to be proven.
Account number never stored
The server only keeps an HMAC-SHA256 fingerprint of your number, calculated with a secret key. A database leak would not reveal the numbers.
No IP address linked to an account
The API only links your account to your WireGuard public keys and, for the free tier, to a byte counter for the current period.
Signed server list
Ed25519 signature with domain separation, verified by the application, with protection against rollback to an older list.
Keys generated on your device
Your WireGuard private key is created on your device and never leaves it. It is erased from memory after use.
Published code
The code of the applications and server scripts will be published. KAYZEN remains its owner; the licence is currently being chosen.
Public threat model
We document what Kayzen VPN protects against, and above all what it does not protect against: a VPN does not make you anonymous and does not replace antivirus software.
What a VPN does not do
- It does not make you anonymous: websites can still recognise you through your accounts, your cookies or your browser fingerprint.
- It does not protect against malware already present on your device.
- It shifts trust from your internet service provider to us: that is why we publish our criteria and our evidence.
Have you found a vulnerability?
Report it responsibly: we will reply to you and credit you if you wish.