Security and Protocols
A technical look at what protects your traffic and account data — without marketing language, and with an honest account of the limits of what we can guarantee.
Connection protocol
HamikVPN runs on AmneziaWG — a fork of WireGuard with transport-layer obfuscation. The cryptographic core is unchanged: key exchange on the Curve25519 elliptic curve, data encryption with ChaCha20 paired with the Poly1305 authentication code, and BLAKE2s hashing — the same set of algorithms as in original WireGuard, which has been through independent cryptographic review. Obfuscation (randomized junk packets and headers) changes only how the traffic looks from the outside, not how it's protected on the inside.
What we don't log
We do not keep a log of your internet activity: we do not store a history of the sites you visit, DNS queries, or the contents of the traffic that passes through the tunnel. To operate the service we process a minimal set of technical connection metadata — a detailed and precise list is in the privacy policy; it's not a marketing phrase but the actual list of what's stored in the database.
Account password storage
Your dashboard password is stored only as a cryptographic hash — we never see or store it in plain text, not even temporarily. When you sign in through Telegram, no password is used at all.
Website and dashboard protection
The connection to the hamik.site website and the dashboard runs over HTTPS/TLS. Session tokens are stored locally in your browser (localStorage) and are not shared with third parties, other than being sent to our own API server.
Honestly, about the limits of our guarantees
No service can guarantee absolute protection. We don't yet have a separate public infrastructure audit from an independent third party — if that matters for your use case, factor it into your decision. What we can do is explain precisely and without exaggeration what happens technically, and not call it something it isn't. For more on why the service is built as self-hosted, see the about page.
What's worth doing on your side
Encrypting the channel is only one layer of protection. Useful habits for the rest: two-factor authentication for important accounts, a password manager instead of reused passwords, and a basic device check — see the checklist in our article on Android security.