Security Architecture

Don't Trust Us. Verify.

Open protocols, precise data boundaries and controls you can inspect. Independent audits of CipherShift have not yet been published.

Sensitive VPN configuration is kept in temporary memory and the data plane is configured not to record browsing destinations, DNS requests or traffic contents. You can replace persistent peer keys on demand. We use open protocols and publish a monthly warrant canary.

Dedicated Server Architecture

Each paid subscriber gets a private cloud server. Its public address is not concurrently shared with other CipherShift subscribers, so their activity cannot shape its reputation.

Data-Minimising Design

The encrypted tunnel starts on your device. The VPN data plane is configured not to record browsing destinations, DNS requests or traffic contents.

No Logs Infrastructure

The VPN data plane does not record browsing destinations, DNS requests or traffic contents. Account, billing, device-session and server-lifecycle data are covered by our privacy policy.

RAM-Only Servers

Sensitive VPN configuration is mounted in temporary memory rather than persisted to disk. Restarting the server clears that in-memory state.

Signature Feature

CipherShift Key Rotation

Most VPNs generate keys once and use them for months. With CipherShift you rotate keys with one tap any time, and Pro adds automatic rotation on a 12, 24, 48 or 72 hour schedule. Old keys are deleted, not archived.

How It Works

1

Connection

New session keys generated

2

Rotation

Timer triggers key refresh

3

Destruction

Old keys wiped from memory

4

Continuity

No reconnection needed

One tap

On-Demand Rotation

Replace the persistent peer keys associated with your server at any time. WireGuard handles short-lived session-key rotation separately.

Scheduled

Auto Rotation (Pro)

Pro plans rotate keys automatically on a schedule you choose: every 12, 24, 48 or 72 hours. Set it once and forget it.

Seamless

No Reconnection

Rotation updates your tunnel in place, so your connection keeps running. No dropped sessions while keys refresh.

Pro Feature

Ghost Mode

Using the VLESS + REALITY protocol, Ghost Mode makes your traffic look like a normal HTTPS connection to a legitimate website, so it is much harder for deep packet inspection to flag.

Designed for: Hostile network environments where standard VPN protocols are quickly detected and blocked.

Protocols & Encryption

Industry-leading protocols, properly implemented.

WireGuard

Use at home or on trusted networks. Reconnects instantly and uses minimal battery. Just 4,000 lines of code (vs 400,000 for OpenVPN) means fewer places for bugs.

Default

Shadowsocks

Use when WireGuard gets blocked. Disguises VPN traffic as normal internet use. Gets through basic network filters that try to detect and block VPN connections.

Included

VLESS + REALITY

Use on hostile networks. Ghost Mode makes your connection look like normal HTTPS traffic to real websites. For aggressive censorship environments where other protocols fail.

Pro

Encryption Standards

Key ExchangeCurve25519
Symmetric EncryptionChaCha20-Poly1305
Hash FunctionBLAKE2s
Key DerivationHKDF

Infrastructure Security

How we protect your dedicated server.

Multi-Cloud, Independent Providers

Servers are distributed across multiple independent cloud providers, so there is no single point of failure and no single provider has the full picture. Region choice affects latency and which local services you can reach. It is not a legal shield.

Isolated Instances

Each user's server is a separate VM instance. No shared processes, no shared memory, no risk of cross-contamination.

Locked-Down Management

Management access is key-based rather than password-based. Servers are provisioned automatically and administrative access is restricted to operational maintenance.

Ephemeral by Design

Sensitive VPN configuration and active keys use RAM-backed storage rather than persistent disk. Account, billing and server-lifecycle records remain in the control plane as described in the privacy policy.

Transparency

We show our work because “trust us” isn't good enough.

Warrant Canary

Reviewed at each product release. If we receive a government order we cannot disclose, the canary will not be updated.

Verifiable by Design

RAM-only configuration reduces persistent secrets on each VPN server. Open protocols and the signed warrant canary are inspectable today. An independent CipherShift security audit remains future work.

Open Protocols

Found a Vulnerability?

We run a responsible disclosure program. Report security issues and help us keep CipherShift secure for everyone.