Modern, standard encryption
We use well-reviewed, publicly documented cryptography. We do not write our own ciphers and we will not describe any part of UmbraVPN as proprietary encryption.
Security
Serious about security, quiet about claims.
Security marketing is easy to write and hard to verify. Below is how UmbraVPN is designed — with nothing asserted that has not been decided.
Secure authentication
Passwords are never stored in readable form. Sign-in is rate limited, sessions are issued server-side, and you can end them from your account.
Account protection
Sensitive actions — changing your email, password, plan or devices — are authorised on the server. Nothing important is decided by the browser alone.
Device security
Devices are bound to your account, listed for you to review, and removable. A removed device loses its access.
Protocol approach
The applications will use a modern, well-established VPN protocol. We will publish the specifics once the implementation is final rather than guessing here.
Infrastructure
Access to production systems is restricted and administrative actions are logged. Infrastructure details are published only where doing so does not reduce security.
Updates
Security fixes are treated as the highest priority release class, for both the applications and this website.
Vulnerability handling
If you believe you have found a vulnerability, contact us before disclosing it publicly. We will confirm receipt and keep you informed while we fix it.
What we are not claiming
No third-party security audit has been completed. No security certifications have been issued. No encryption used by UmbraVPN is proprietary. If any of that changes, this page changes with it.