Core concepts

A few ideas make everything else click.

The mesh

Your machines form a private mesh: encrypted, peer-to-peer links (WireGuard) where devices reach each other directly, wherever they are on the network. There are no public ports.

Node vs device

A node is any machine on the mesh (a laptop, a server, a phone). A device is a node you personally own. In the app, nodes usually appear as “devices”.

Overlay address

Each node gets a private overlay IP (an IPv6 ULA, e.g. fd00:…). It’s how nodes reach each other. It’s random and can rotate — it is not a stable identifier, by design.

Control plane vs data plane — the sovereignty split

This is the core idea:

• The control plane (the vendor) brokers identity and policy — who you are, what’s allowed. It never carries your data.
• The data plane is your traffic. It goes directly between your devices. The vendor is not on it, and can’t decrypt it.

This separation is structural, not a setting — see Sovereignty.

Prove It

Because the vendor is off the data path, you can verify it yourself: the path chain shows the live route (direct peer-to-peer, the real endpoint, “Vendor in path: No”). Proof you hold, not a promise you trust. See Prove It.