How NgalimPass protects you

Your connection

• WireGuard tunnel with a separate key pair for every device. The private key is generated on the device and kept in its secure storage.
• The tunnel carries all IPv4 and IPv6 traffic. DNS lookups go through the tunnel to Cloudflare's 1.1.1.1 resolver.
• The optional TLS mode (Android) wraps the tunnel in a standard encrypted web connection for networks that block VPN traffic.
• There is no kill switch yet: if the tunnel stops, traffic leaves through your normal connection.

Your account

• Passwords are stored only as Argon2 hashes and must be at least 12 characters.
• New accounts are confirmed by a single-use email link that expires. You choose your password on the page that link opens, so nobody else can claim your email address with a password of their own. The apps use the same sign-up.
• Sign-in sessions expire. Changing your password signs out all your other sessions.
• Removing a device from your account withdraws its access from the VPN server.
• For now you sign in and sign up in the apps. These pages have no forms and never ask for your password.

Payments

NgalimPass doesn't take payments online yet. When it does, card details will be handled entirely by the payment provider and never stored by NgalimPass.

Reporting a vulnerability

A security contact will be published here before public launch.