Security

How we protect you

• Your key stays with you. Each device makes its own private key and never sends it to us.
• Passwords are scrambled. We store a salted hash, never the password itself.
• Two-step sign-in. You can turn it on from your account. Our own staff always have to use it.
• Staff actions are recorded. Anything a member of our team changes on an account is logged with a reason, and the log cannot be edited.
• Card details never reach us. They go from your browser straight to our payment provider.
• The servers defend themselves. They block addresses that guess logins or probe for weaknesses, and keep only counts.
• A kill switch in the app. If the tunnel drops, traffic stops instead of leaking.

What you can do

• Use a long, unique password and turn on two-step sign-in.
• Keep the app up to date.
• Never share your setup file. It contains your device key.
• Be wary of emails asking for your password. We will never ask for it.
• Run the leak check any time you want to see what your browser is really doing.

Found a problem?

If you think you have found a weakness in ZaRVPN, please tell us before telling anyone else. Write to security@zarvpn.com with what you found and how to reproduce it. We will read it, reply, and fix real problems as fast as we can.

We ask that you only test against your own account, do not read or change other people's data, do not run anything that slows the service for others, and give us a reasonable time to fix it before you go public. If you act in good faith like this, we will not take action against you. Our contact details are also in security.txt.

What we cannot promise

No service is perfectly secure, and anyone who says theirs is, is not being straight with you. If something ever goes wrong that affects your data, we will tell you quickly and plainly, and tell the Information Commissioner's Office where the law requires it.