Application audit logs
Provisioning, enrollment, customer-account and admin services record bounded operation names, outcomes, timestamps, usernames when operationally needed, assigned VPN addresses in some provisioning events and safe error categories. These logs exclude passwords, private keys, full client configurations, verification/reset tokens, enrollment codes and raw billing webhooks.
Live WireGuard state
WireGuard exposes peer public keys, allowed VPN addresses, latest-handshake times and aggregate traffic counters. Operators can request this live state. The application does not create browsing-history or DNS-query records.
Infrastructure
The public account and enrollment reverse-proxy configurations disable access logs. Error logs, systemd journals and provider security logs remain separate from application audit logs. Hosting, email, payment and DNS providers may process metadata under their own policies.
Retention boundaries
The protected application log uses a 10 MiB rotation threshold and retains up to 12 rotated archives. This is a size/rotation limit, not a promise to erase logs after a fixed number of days. In-memory web sessions last up to eight hours and device enrollment codes expire after ten minutes.
Account, billing, device and consumed-token rows, revoked credentials and protected backups are not automatically erased when a token expires, a device is revoked or a subscription ends. They remain subject to operator review and applicable retention obligations. Privacy requests can be made through the contact details in the privacy policy.