Califax VPN

All Califax VPN infrastructure runs exclusively in volatile memory (RAM). There are no hard drives or persistent storage devices on any server node. When a server reboots — whether scheduled or unexpected — all data is automatically and irrecoverably purged. This architecture makes it physically impossible for data to be retained, seized, or subpoenaed from our infrastructure.

Encryption is performed entirely on the client device before data ever leaves your machine. Session keys are ephemeral and regenerated for every connection. All DNS queries are routed through DNS-over-HTTPS (DoH) to prevent DNS leak attacks. We maintain zero metadata logging — no connection timestamps, no bandwidth logs, no IP address records.

User identity and access control are managed through decentralized verification. The system allows users to prove their identity and access level without revealing personal information. Access verification is trustless and independently auditable.

Our warrant canary system publishes a cryptographically signed statement every 72 hours confirming that no government warrants, gag orders, or national security letters have been received. If the canary is not updated within 96 hours, the dead-man switch activates automatically. The canary is independently verifiable — no trust required.

All server-side cryptographic keys are stored in certified hardware security vaults. Key material never leaves the tamper-proof hardware in plaintext. Master keys are rotated on a quarterly schedule for maximum security.

Access levels are enforced through decentralized verification. Each user has a trust score that increases with account age and activity. All access decisions are independently verifiable. The policy engine is fully transparent — anyone can audit and verify that access rules are applied consistently and without bias.