A warrant canary is only worth the day someone checks it

Every VPN says the same things. Private. Secure. We would never hand over your data. The sentences are cheap to write and there is usually nothing attached to them that a customer could ever test.

That is the real problem with VPN marketing. Not that companies lie, though some do, but that the claims are built so that lying and telling the truth look identical from the outside.

A warrant canary is one of the few privacy claims that has a test attached. It is worth understanding properly, including the parts that are weaker than the people who like them tend to admit.

What it actually is

A warrant canary is a dated public statement that says nothing has happened yet. Something like: as of this date, we have received no secret legal demand for user data.

The trick is what happens next. In several jurisdictions a company served with a secret order can be forbidden from telling anyone it received one. Being compelled to speak is a different legal question from being forbidden to speak, so the theory goes that a company can stop publishing a routine statement even when it cannot make a new one.

So the message is never the note. The message is the day the note stops getting updated, or quietly disappears.

Which means a canary transmits exactly one bit of information, and only to people who were watching. If nobody has the old version, nobody can tell it changed.

The honest weaknesses

Anyone selling you a canary as a guarantee is overselling it.

The legal theory has never been properly tested in court, in the US or anywhere else. A judge could decide that pulling the canary is itself a prohibited disclosure. The EFF ran a project called Canary Watch to track these things and shut it down in 2016, partly because canaries turned out to be ambiguous in practice: they go stale by accident, wording drifts, and readers over-interpret both. The EFF's ongoing work on surveillance and secret orders is worth more of your time than any single company's canary page.

A canary also says nothing about competence. It does not tell you whether the servers are configured well, whether the client leaks, or whether a third party has ever looked at the code.

And it is trivially defeated by a company that never had a canary in the first place, which is most of them.

Why we keep one anyway

Because the alternative is asking you to take our word for it, and we would rather give you something with a date on it.

Pangea publishes a warrant canary on the site. Check the date. If it ever goes stale, that is not a website maintenance issue to shrug at, that is the entire point of the thing.

The canary is also not the strongest checkable claim we have, and we would rather you leaned on the other two.

The client is open source, GPLv3, on GitHub. You do not have to believe our description of what the app does. You can read what it sends and when. The desktop app generates your keys on your own device, and that is a property you can verify in the source rather than a promise in a privacy policy. Traffic is protected with 256-bit encryption, WireGuard and ChaCha20 under the hood, which is not exotic and is not supposed to be.

You can avoid handing us an identity at all. Pay in crypto, Monero included, and there is no email, no card, and no KYC on the account. Data you never gave us is not data anyone can compel out of us later. That is a structural claim rather than a promise about our future behaviour, which is the only kind of claim worth much.

We have not been audited by a third party. When that changes we will say so, and until then we are not going to imply otherwise, because a company that fudges the easy verifiable facts is telling you exactly how it treats the hard ones.

How to check anyone, including us

A short routine that costs you ten minutes and works on any provider.

1. Find the canary. Note the date. Put a reminder in your calendar for a month out and look again. If there is no canary, that is information too.
2. Find the client source. Not a GitHub organisation with a marketing site in it, the actual app you install. If the thing you download cannot be traced to code you can read, "open source" is decoration.
3. Go to checkout and count what it asks for. Email, card, billing address, phone. Every field is a record that exists whether or not anyone ever misuses it.
4. Read what they say about audits, and check whether the audit covers the current infrastructure or something from four years ago.
5. Ask what happens on a network that blocks VPN connections outright. Plenty of providers have never had to answer this, because their product quietly fails and the customer blames the wifi.

Do that to us. We would rather have customers who checked than customers who were convinced.

Five days free, no card needed, if you want to test the thing rather than the copy. See pricing.