Skip to content

Threat model

ClassExampleKatafract posture
Passive observer on your local networkCoffee-shop Wi-Fi snifferDefeated by WraithVPN (WireGuard) + Haven (DoH) + TLS for every katafract.com service.
Active MITM at your ISPISP injecting ads or cert-pinning downgradeDefeated by the same. Client pins Katafract endpoints.
DPI / anti-VPN at a state or corporate firewallChina GFW, Iran restrictions, hotel DPI appliancePartially defeated. Shadowsocks + v2ray-plugin is the fallback. AmneziaWG was deprecated in April 2026 in favor of SS-TLS.
Device compromiseMalicious app / stolen device with unlocked biometricOut of scope. If your device is compromised, the attacker operates as you.
Server compromise at KatafractControl plane breachedToken revocation + audit logs + secrets in Infisical limits blast radius. Vaultyx is zero-knowledge so server breach does not disclose file content. WireGuard config is regenerated per-session so a breach does not disclose past session keys.
Legal compulsion against KatafractSubpoena for user recordsWe can produce: subscription metadata (email, plan, billing country via Stripe). We cannot produce: content of encrypted files, DNS query history per user, VPN session contents. Warrant canary at katafract.com/canary.html.
State-level traffic correlation across jurisdictionsAdversary that can observe both your entry and exitOut of scope for any single-hop VPN. Multi-hop VPN in Sovereign moves the correlation window but does not eliminate it. If your threat model is nation-state correlation, use Tor.
  • A malicious actor with physical access to an unlocked device.
  • A browser extension you installed.
  • Metadata inherent to a request (who are you talking to, how often, how big a payload).
  • Traffic-analysis attacks against Tor or anything resembling one. Katafract is not Tor and we do not claim it is.
  • Someone else being logged into your App Store account who downloads Katafract apps on their device. Subscription binds to Apple ID, not identity.
  • VPN nodes: session logs disabled. wg show output is transient state in kernel memory. journalctl is rotated + cleared weekly. Node heartbeats to artemis carry aggregate counters (peer count, bytes transferred per interface), never per-peer payloads.
  • DNS nodes: AdGuard Home query log disabled. Statistics page shows aggregate counts only.
  • Artemis API: audit log of account actions (signup, plan change, token issue, device add/remove). Content-free.
  • Argus Postgres: rows for subscriptions, peers, tokens. Never queries, never file contents.
  • Vaultyx: server sees opaque chunk hashes + ciphertext bytes + encrypted filename blobs. Server does not hold a key capable of decrypting any of it.
  • Before a new route ships on artemis-api, a reviewer greps the diff for SQL that lacks AND user_id = %s — the tenant-isolation rule caught a cross-tenant cascade-delete bug in April 2026 that was patched same-day.
  • Node configs are ansible-generated from one source of truth. Drift is detected by nightly etckeeper comparison.
  • Quarterly we publish aggregate transparency numbers (subscriber count, warrant count, canary update). Quarterly cadence is locked in the editorial calendar.
  • If your adversary is a nation-state that can observe both your entry and exit: use Tor, not WraithVPN.
  • If you need provably plausible-deniable storage: use VeraCrypt hidden volumes, not Vaultyx. Vaultyx is zero-knowledge but not deniable.
  • If you are hosting content that could bring the platform under coordinated legal pressure: use dedicated hosting you control. Katafract is not a publishing platform.