Sign in Get NodeDistro VPN

Security

A smaller set of claims, kept.

The protection is the tunnel, the key handling, and the records we refuse to store. It is not a promise that a network path is invisible.

Keys and tunnels

WireGuard is the only tunnel protocol.
Device private keys are generated on the device. The control plane stores the public key and an address from 10.80.0.0/16.
Server private keys stay on the node. A customer config never includes them.
Customers reach a node through the public API and the control plane. They cannot call node management routes.

Accounts

Passwords are hashed with Argon2id. Sessions rotate. Authenticator codes are optional.
API keys are scoped. A node credential cannot be used as a customer key.
Administrative actions are permission-checked and written to the audit log.
Registration tokens for a new server expire, work once, and are stored only as a keyed hash.

What we keep

Account, billing, device, and connection-management records.
We do not keep browsing history, page URLs, or traffic contents.
NodeDistro VPN does not describe the service as anonymous or zero-log.

Create an account and connect a device.

The device keeps its private key. The API assigns a server that is actually online.

Get NodeDistro VPN Compare plans