Military-grade VLESS+Reality protocol. Your traffic looks like a routine visit to Microsoft's servers. Undetectable by DPI. Unblockable by censors.
Not another OpenVPN reskin. A fundamentally new architecture that makes your traffic cryptographically invisible.
Borrows a legitimate website's TLS fingerprint. Observers see traffic to microsoft.com — not a VPN server.
Inner TLS splicing eliminates double-encryption. Up to 50% faster than OpenVPN on HTTPS-heavy workloads.
Routes through Cloudflare's global edge when direct connections are blocked. Your IP stays hidden behind 300+ PoPs.
Elliptic curve cryptography with 128-bit security level. Timing-attack resistant. No weak RSA parameters.
Xray log level is set to "warning" — errors only, zero connection metadata, zero IP records, zero timestamps.
Statistically indistinguishable from a standard TLS 1.3 session. Deep Packet Inspection sees nothing unusual.
The Reality handshake is the core innovation — it's not just encrypted, it's impersonating legitimate HTTPS traffic at the TLS layer.
Your device initiates a TLS 1.3 handshake to our server on port 443 — the same port as every HTTPS website.
The server relays your handshake to microsoft.com and returns their authentic TLS certificate. Any observer sees a Microsoft TLS session.
Within the TLS session, your client and server verify each other using the X25519 keypair. Only valid clients get through.
Proxied requests exit from our AWS node. Websites see the server IP, never yours.
A custom, native client built for our network — no third-party apps needed. The VPN engine is bundled in; just install, paste your profile, and connect.
Linux: sudo apt install ./Private-Panda.deb, then launch
Private-Panda from your app menu. ·
Windows: run the installer, then launch from the Start Menu (admin prompt
creates the secure tunnel adapter).
Our architecture is designed so that even a court order couldn't produce traffic logs — because none exist.
The server runs Xray-core configured with "loglevel": "warning". At this setting, Xray writes only unhandled error events — it does not log inbound connections, outbound destinations, user UUIDs, client IPs, or traffic volumes.
No connection database exists on the server. If you sent a subpoena today, the response would be: no records to produce.
The single-tenant model means your UUID is the only UUID on the instance. Even if server memory were somehow imaged, it would contain only your own in-flight session data — and nothing persisted to storage.