Enterprise-grade technology, consumer-grade experience

Who we are

We are an enterprise-grade secure connection service built for cross-border users. The complex connection engineering stays behind the scenes, so on your phone or computer it comes down to two steps—one-tap import, one-tap connect—as natural as using your local network.

The service is built on the mature, open OpenConnect standard protocol: a widely proven ocserv server on our side, clients compatible with an enterprise security client available in mainstream app stores (Cisco Secure Client), and open-source clients such as OpenConnect and AnyLink for desktop and command-line use. We chose a recognized open ecosystem rather than an obscure proprietary scheme.

On the infrastructure side, we use a 'unified control plane + multi-region edge access nodes' architecture, continuously deploying and operating access nodes across several regions, all coordinated by the control plane.

Authentication and encryption: why client certificates

On iOS, every user authenticates with their own client certificate (Android connects with account + password in one tap, no manual setup either). Our in-house certificate system issues a dedicated certificate per account; after a one-tap import on the phone, later connections need no password—install once, connect password-free for the long run, which is exactly what makes the one-tap mobile experience possible.

Connections are encrypted end to end with industry-standard TLS and DTLS: TLS for the control channel, DTLS for the data channel, protecting data in transit from being read or tampered with along the way. We don't pile on inflated marketing terms for encryption—we simply do what widely vetted standard protocols are meant to do.

Key isolation, by design

Security is an architectural choice, not a slogan. We issue every account its own connection credential, and the most sensitive key it depends on is held separately on the principle of minimum exposure — never on any public-facing system, and never shipped with the service; credentials can be revoked when needed.

We don't rely on the assumption that 'nothing will go wrong'; we rely on boundary design. How that key is stored and accessed is not disclosed publicly — that is part of the protection. These invisible trade-offs are exactly where enterprise-grade differs from consumer-grade.

Reliable by design: multiple nodes, continuous monitoring, automatic failover

We continuously monitor whether each access node is usable and act on problems ourselves, rather than waiting for you to hit a dead line.

If a line wobbles or fails, the client automatically switches to an available node using its built-in backup server list, doing its best to keep the connection alive. Together with a TCP-based super tunnel tuned for restrictive network conditions, we aim to stay smooth across a wide range of environments. These are running mechanisms, not advertising slogans.

A dedicated channel and one-tap access everywhere

We offer both full-tunnel and split-routing (domestic-direct) modes: in split mode, domestic destinations go straight over your local network while the rest enters the encrypted channel, balancing speed and experience. Each user also gets their own access address and encrypted channel—everyone travels through their own, so connections are steadier, more resilient, and less likely to affect one another.

Whether iOS, Android, Windows, macOS, Linux, or select router environments, we provide one-tap importable connection profiles compatible with multiple mainstream clients, ready out of the box across platforms. Desktop and command-line environments can use open-source clients such as OpenConnect / AnyLink, with no lock-in to a single app.

Privacy and data minimization

We collect only the traffic-usage data necessary for plan-quota accounting (upstream and downstream byte counts), used to reconcile your allowance and transparently viewable in your member panel. We do not sell your personal information, and we do not record which websites you visit or your browsing content.

To be honest with you, we won't claim 'zero logs'—for billing and abuse prevention we do retain necessary connection metadata such as traffic byte counts. But what we record, and why, is written in our Privacy Policy, and it matches what we actually do. Data minimization is a principle we hold to.

Transparent pricing and support you can actually reach

Registration automatically grants a free trial—try before you buy, so you can experience the service on a real network before you ever pay. Plans differ by data allowance and peak-speed tier; see the plans comparison table for exact figures. The rules are clear, published on the plans page, with no hidden terms.

When something goes wrong, you can submit a ticket directly inside the member panel, with support in both Chinese and English, and every issue is recorded and followed up. The product is intentionally operated anonymously—so we don't vouch for ourselves with a founder's halo or headline user counts. What we do stand behind is verifiable technology, consistent policies, and a support channel you can actually reach.