Security Overview
Every Layer, Builtto Protect You
From the encryption on the wire to the servers on the other end, here's exactly what protects your connection — and how each piece is verified, not just claimed.
AES-256 & ChaCha20 encryption
Independently Audited
RAM-only servers
The foundation
Encryption Strong Enough for Governments and Banks
Every connection is wrapped in AES-256 or ChaCha20 encryption, the same standards used to protect classified data and financial systems. Each session uses a unique key through Perfect Forward Secrecy, so even if one key were ever exposed, it couldn't unlock any other session, past or future.
Compare our protocols
Full picture
Every Security Feature, in One Place
Each of these does a specific job — together, they cover the whole connection.
Kill switch
Cuts your internet the instant the VPN drops, so your real IP is never exposed even for a second.
DNS & IPv6 leak protection
Every DNS query stays inside our own resolvers, and IPv6 traffic is blocked unless it's also tunneled.
Strict no-logs policy
No browsing history, timestamps or IP addresses kept — independently verified, not just promised.
RAM-only servers
Every server runs entirely in memory — nothing is ever written to a hard drive to begin with.
Split tunneling
Choose exactly which apps go through the VPN and which use your regular connection.
Perfect Forward Secrecy
A fresh encryption key for every session — exposing one key later couldn't unlock past traffic.
End to end
How Your Traffic Stays Secure
Three layers working together, from the moment you hit connect.
Step 01
Encrypted handshake
Your app and the server exchange keys the moment you connect — before any of your traffic moves.
Step 02
Traffic tunneled & hidden
Everything passing between you and the server is unreadable to your ISP or anyone else on the network.
Step 03
Protected, even if it drops
If the connection ever fails, the kill switch cuts your internet rather than letting anything leak unprotected.
Not just the right name
Correctly Implemented, Not Just Correctly Named
Using AES-256 badly is still insecure. What actually matters is the implementation: correct handshakes, proper key exchange, and cipher configuration that doesn't quietly weaken the protection. This is exactly what our independent security audits examine, rather than taking the protocol name at face value.
See the audit findings →
Verified, not self-certified
None of This Is Taken on Faith
Every claim on this page — the encryption, the no-logs policy, the server infrastructure — is checked by an independent security firm on a recurring basis, with findings published rather than kept private. Security you can only take our word for isn't really verified security.
Read the no-logs policy →
The short version
Everything, at a Glance
Modern encryption
AES-256 and ChaCha20, implemented correctly and reviewed by outside auditors.
Automatic kill switch
On by default, cutting your connection rather than letting anything leak unprotected.
Verified No-Logs
Confirmed by independent audit, not just written into a policy page.
Diskless Infrastructure
RAM-only servers across the entire network, with nothing written to disk.
Granular Control
Split tunneling and protocol choice put you in charge of exactly how traffic is routed.
Responsible Disclosure
A clear path for researchers to report issues directly, taken seriously when they do.
Found a security issue?
We take every credible report seriously. Let us know directly and our team will follow up.
Frequently Asked Questions About Our Security
AES-256 or ChaCha20, depending on the protocol, with Perfect Forward Secrecy generating a unique key for every session.
Yes, it's enabled by default on every platform. It can be turned off in settings, though we'd recommend leaving it on.
An independent security firm examines the server infrastructure directly. Details are on ourno-logs policyandSecurity Auditspages.
Split tunneling lets you choose which apps route through the VPN and which use your normal connection. Most people don't need it, but it's useful for accessing local devices while still protecting specific apps.
No — a VPN encrypts traffic in transit and doesn't scan files on your device, so it doesn't compete for resources the way antivirus software can. It's a complement to good security hygiene, not a replacement for it.
Use theReport a Security Issuepage. Every credible, responsibly disclosed report is reviewed and followed up on.
Security You Can Actually Check
Every layer described here is live in the app today — download it and see for yourself.
Download ASTRO VPN